GHSA-49wp-qq6x-g2rfHighCVSS 8.8

Cross-site Request Forgery in fastify-csrf

Published
January 20, 2021
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2020-28482 →

📋 Description

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection.

  1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true }
  2. The CSRF token was available in the GET query parameter

🎯 Affected products1

  • npm/fastify-csrf:< 3.0.0

🔗 References (6)