CVE-2018-3711: Denial of Service vulnerability with large JSON payloads in fastify

Background

Fastify is an open-source web framework for Node.js that focuses on providing high-performance and low-overhead for web applications. It is known for its speed and efficiency in handling HTTP requests. However, versions of fastify up to 0.37.0 are vulnerable to a Denial of Service (DoS) attack when processing a request with a large JSON payload and the 'Content-Type' header set to 'application/json'. This vulnerability can be exploited to overload the server and cause it to become unresponsive.

Vulnerability Detail

The vulnerability arises due to a lack of proper validation and handling of large JSON payloads. When a request with a large JSON payload is received, fastify attempts to process it, leading to excessive memory consumption and CPU usage. This can result in the server becoming overwhelmed and unable to handle other requests, effectively causing a DoS condition. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.

npm install fastify@0.38.0

Workaround

If updating fastify is not immediately feasible, a temporary workaround can be implemented by limiting the maximum payload size for JSON requests. This can be achieved by adding a request payload size limit middleware to the application. Here's an example of how to implement this workaround using fastify-rate-limit middleware:

const fastify = require('fastify');
const rateLimit = require('fastify-rate-limit');

const app = fastify();

app.register(rateLimit, {
  max: 1024, // Maximum payload size in bytes
  timeWindow: '1 minute',
  errorResponseBuilder: function (req, context) {
    return { error: 'Payload too large' };
  }
});

// Rest of the application code

app.listen(3000, (err) => {
  if (err) {
    console.error(err);
    process.exit(1);
  }
  console.log('Server is running');
});

Conclusion

In conclusion, fastify versions up to 0.37.0 are vulnerable to a Denial of Service (DoS) attack when processing large JSON payloads. To mitigate this vulnerability, it is crucial to update fastify to version 0.38.0 or later. Alternatively, a temporary workaround can be implemented by limiting the maximum payload size for JSON requests. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for fastify →

FAQ