CVE-2022-41919
highpriority · track · 35EPSS 0.004 · 34 %ileEUUSEPSS · scored 2026-10-27
Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.2–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-3fjj-p79j-c9hhFastify: Incorrect Content-Type parsing can lead to CSRF attack 2022-11-21ghsa · osvUS
### Impact The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s [essence](https://mimesniff.spec.whatwg.org/#mime-type-essence) as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any [CORS protection](https://fetch.spec.whatwg.org/#simple-header), and therefore they could lead to a Cross-Site Request Forgery attack. ### Patches For `4.x` users, please update to at least `4.10.2` For `3.x` users, please update to at least `3.29.4` ### Workarounds Implement Cross-Site Request Forgery protection using [`@fastify/csrf`](https://www.npmjs.com/package/@fastify/csrf). ### References Check out the HackerOne report: https://hackerone.com/reports/1763832. ### For more information [Fastify security policy](https://github.com/fastify/fastify/security/policy)
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-41919/cnnvd
- https://github.com/fastify/fastify/commit/62dde76f1f7aca76e38625fe8d983761f26e6fc9cnnvd
- https://github.com/fastify/fastify/security/advisories/GHSA-3fjj-p79j-c9hhcnnvd
- https://www.npmjs.com/package/@fastify/csrfcnnvd
- https://github.com/fastify/fastify/commit/62dde76f1f7aca76e38625fe8d983761f26e6fc9enisa_euvd
- https://github.com/fastify/fastify/security/advisories/GHSA-3fjj-p79j-c9hhenisa_euvd
- https://www.npmjs.com/package/%40fastify/csrfenisa_euvd
- https://github.com/fastify/fastify/commit/62dde76f1f7aca76e38625fe8d983761f26e6fc9PatchThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan