netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-mg2h-6x62-wpwc

Browse Source
This commit is contained in:
advisory-database[bot]
2025-04-18 20:39:59 +00:00
parent db4c9dd0f6
commit ddb8104da9
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/04/GHSA-mg2h-6x62-wpwc/GHSA-mg2h-6x62-wpwc.json
+8 -4
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mg2h-6x62-wpwc",
"modified": "2025-04-18T18:34:35Z",
"modified": "2025-04-18T20:38:47Z",
"published": "2025-04-18T15:02:41Z",
"aliases": [
"CVE-2025-32442"
],
"summary": "Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass",
"details": "### Impact\n\nIn applications that specify different validation strategies for different content types, it's possible to bypass the validation by providing a _slightly altered_ content type such as with different casing or altered whitespacing before `;`.\n\nUsers using the the following pattern are affected:\n\n```js\nfastify.post('/', {\n handler(request, reply) {\n reply.code(200).send(request.body)\n },\n schema: {\n body: {\n content: {\n 'application/json': {\n schema: {\n type: 'object',\n properties: {\n 'foo': {\n type: 'string',\n }\n },\n required: ['foo']\n }\n },\n }\n }\n }\n})\n```\n\nUser using the following pattern are **not** affected:\n\n```js\nfastify.post('/', {\n handler(request, reply) {\n reply.code(200).send(request.body)\n },\n schema: {\n body: {\n type: 'object',\n properties: {\n 'foo': {\n type: 'string',\n }\n },\n required: ['foo']\n }\n }\n})\n```\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\n\nDo not specify individual content types in the schema.\n\n### References\n_Are there any links users can visit to find out more?_\n\nhttps://hackerone.com/reports/3087928",
"details": "### Impact\n\nIn applications that specify different validation strategies for different content types, it's possible to bypass the validation by providing a _slightly altered_ content type such as with different casing or altered whitespacing before `;`.\n\nUsers using the the following pattern are affected:\n\n```js\nfastify.post('/', {\n handler(request, reply) {\n reply.code(200).send(request.body)\n },\n schema: {\n body: {\n content: {\n 'application/json': {\n schema: {\n type: 'object',\n properties: {\n 'foo': {\n type: 'string',\n }\n },\n required: ['foo']\n }\n },\n }\n }\n }\n})\n```\n\nUser using the following pattern are **not** affected:\n\n```js\nfastify.post('/', {\n handler(request, reply) {\n reply.code(200).send(request.body)\n },\n schema: {\n body: {\n type: 'object',\n properties: {\n 'foo': {\n type: 'string',\n }\n },\n required: ['foo']\n }\n }\n})\n```\n\n### Patches\n\nThis was patched in v5.3.1, but unfortunately it did not cover all problems. This has been fully patched in v5.3.2.\n\n### Workarounds\n\nDo not specify multiple content types in the schema.\n\n### References\n_Are there any links users can visit to find out more?_\n\nhttps://hackerone.com/reports/3087928",
"severity": [
{
"type": "CVSS_V3",
@@ -28,13 +28,13 @@
"introduced": "5.0.0"
},
{
"fixed": "5.3.1"
"fixed": "5.3.2"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 5.3.0"
"last_known_affected_version_range": "<= 5.3.1"
}
}
],
@@ -51,6 +51,10 @@
"type": "WEB",
"url": "https://github.com/fastify/fastify/commit/436da4c06dfbbb8c24adee3a64de0c51e4f47418"
},
{
"type": "WEB",
"url": "https://github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3087928"