Denial of service in fastify

GHSA-xw5p-hw6r-2j98 · CVE-2020-8192

Published Aug 5, 2020 · Modified Nov 8, 2023

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-8192
WEB https://github.com/fastify/fastify/commit/74c3157ca90c3ffed9e4434f63c2017471ec970e
WEB https://hackerone.com/reports/903521

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Denial of service in fastify

Description

References

More npm vulnerabilities

Start Securing