Vulnerability record · CVE-2022-41919 · published 22 November 2022
CVE-2022-41919: Fastify cross-site request forgery vulnerability
Fastify · Fastify
Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'.
Description
Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/fastify/fastify/commit/62dde76f1f7aca76e38625fe8d983761f26e6fc9 | PatchThird Party Advisory |
| https://github.com/fastify/fastify/security/advisories/GHSA-3fjj-p79j-c9hh | Third Party Advisory |
| https://www.npmjs.com/package/%40fastify/csrf | |
| https://github.com/fastify/fastify/commit/62dde76f1f7aca76e38625fe8d983761f26e6fc9 | PatchThird Party Advisory |
| https://github.com/fastify/fastify/security/advisories/GHSA-3fjj-p79j-c9hh | Third Party Advisory |
| https://www.npmjs.com/package/%40fastify/csrf |
Track CVE-2022-41919 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-41919), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
