CVE-2020-8192: Denial of Service in fastify
Summary
CVE-2020-8192: Denial of service in fastify. Affects fastify versions < 2.15.1. Fixed in 2.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js that focuses on providing excellent performance and low overhead. It is designed to be highly efficient and suitable for building scalable applications. However, a vulnerability has been discovered in Fastify versions 2.14.1 and 3.0.0-rc.4 that can lead to a denial of service attack. This vulnerability allows a malicious user to trigger resource exhaustion when the allErrors option is used with specially crafted schemas.
Vulnerability Detail
The vulnerability in Fastify arises from a flaw in the handling of schemas when the allErrors option is enabled. By exploiting this flaw, an attacker can send specially crafted requests that cause the server to consume excessive resources, leading to a denial of service condition. This can result in the server becoming unresponsive or crashing, disrupting the availability of the application. The vulnerability has a moderate severity rating and is classified under CWE-400.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.15.1
This is the first release that contains the fix.
npm install fastify@2.15.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Fastify is not immediately feasible, a temporary workaround can be implemented by disabling the allErrors option in the schema configuration. This can be done by modifying the code that sets up the Fastify server and removing or commenting out the line that enables the allErrors option. However, it is important to note that this workaround may affect the validation behavior of the application and should only be considered as a temporary solution until the package can be updated.
Conclusion
In conclusion, Fastify versions 2.14.1 and 3.0.0-rc.4 are vulnerable to a denial of service attack when the allErrors option is used with specially crafted schemas. To mitigate this vulnerability, it is recommended to upgrade to Fastify version 2.15.1 or later. If immediate upgrade is not possible, disabling the allErrors option can serve as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for fastify →
FAQ
This vulnerability can lead to a denial of service condition, causing the affected Fastify server to become unresponsive or crash. This can result in service disruption and impact the availability of the application.
Fastify versions 2.14.1 and 3.0.0-rc.4 are affected by this vulnerability.
Yes, the vulnerability can be fixed by upgrading to Fastify version 2.15.1 or later.
A temporary workaround is to disable the allErrors option in the schema configuration. However, this may affect the validation behavior of the application and should only be used until the package can be updated.
There is currently no known exploit publicly available for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
