CVE-2020-28482: Cross-site Request Forgery in fastify-csrf
Summary
CVE-2020-28482: Cross-site Request Forgery in fastify-csrf. Affects fastify-csrf versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fastify-csrf package is an npm package that provides Cross-Site Request Forgery (CSRF) protection for Fastify, a web framework for Node.js. It helps prevent unauthorized requests from being made on behalf of authenticated users. The package generates CSRF tokens and adds them to requests to ensure their authenticity. However, versions before 3.0.0 have several vulnerabilities that affect the effectiveness of CSRF protection.
Vulnerability Detail
The vulnerability in fastify-csrf before 3.0.0 arises from insecure defaults and the availability of the CSRF token in the GET query parameter. The package's generated cookie used insecure defaults and did not have the httpOnly flag set, making it vulnerable to cross-site scripting attacks. Additionally, the CSRF token was exposed in the GET query parameter, which could be intercepted and used by an attacker to forge requests on behalf of authenticated users. This vulnerability can lead to unauthorized actions being performed by attackers, potentially compromising the security and integrity of the application.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
npm install fastify-csrf@3.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
npm install fastify-csrf@3.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the fastify-csrf package.
Conclusion
The fastify-csrf package before version 3.0.0 has vulnerabilities that affect its CSRF protection. Upgrading to version 3.0.0 or later is recommended to fix these vulnerabilities and ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for fastify-csrf →
FAQ
fastify-csrf is an npm package that provides Cross-Site Request Forgery (CSRF) protection for Fastify, a web framework for Node.js. It helps prevent unauthorized requests from being made on behalf of authenticated users.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. It occurs when a malicious website or application forces a user's browser to perform unwanted actions on a trusted website where the user is authenticated.
This vulnerability can allow attackers to perform unauthorized actions on behalf of authenticated users. They can manipulate the application's state, access sensitive information, or perform actions that the user did not intend to perform.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify-csrf.
