HIGH7.5
GHSA-mq6c-fh97-4gwv
Denial of Service vulnerability with large JSON payloads in fastify
Quick fix
GHSA-mq6c-fh97-4gwv — fastify: upgrade to the fixed version with the command below.
npm install fastify@0.38.0Details
Affected versions of `fastify` are vulnerable to a denial of service when processing a request with `Content-Type` set to `application/json` and a very large payload.
## Recommendation
Update to version 0.38.0 or later.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-3711[ADVISORY]
- https://github.com/fastify/fastify/pull/627[WEB]
- https://github.com/fastify/fastify/commit/fabd2a011f2ffbb877394abe699f549513ffbd76[WEB]
- https://hackerone.com/reports/303632[WEB]
- https://github.com/advisories/GHSA-mq6c-fh97-4gwv[ADVISORY]
- https://www.npmjs.com/advisories/564[WEB]