CVE-2022-41919 Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type
Attackers can bypass CORS protections and perform CSRF attacks by using specific content types in fetch requests against Fastify routes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-41919?
CVE-2022-41919 is a medium-severity vulnerability in fastify, published on 22 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'.
Weakness: CWE-352
Which versions are affected by CVE-2022-41919?
4 open source packages ship an affected version, including fastify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fastify npm | From 3.0.0 | 3.29.4 |
fastify npm | From 3.0.0 | 3.29.4 |
fastify npm | From 4.0.0 | 4.10.2 |
fastify npm | From 4.0.0 | 4.10.2 |
Products include Fastify Fastify.
How do I fix CVE-2022-41919?
Upgrade fastify to a fixed version for your release line: 3.29.4 or 4.10.2.
Is CVE-2022-41919 being exploited?
There is no known exploitation of CVE-2022-41919 in the wild and no public exploit code.
Other vulnerabilities in fastify
- CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision
- CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas
- CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
Sources
Also known as GHSA-3fjj-p79j-c9hh.