CVE-2022-23623: frourio - Validation Bypass Vulnerability
Summary
CVE-2022-23623: Validation bypass in frourio. Affects frourio versions < 0.26.0. Fixed in 0.26.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Frourio is an npm package used for building web applications with TypeScript and Node.js. It provides a framework for creating APIs and handling HTTP requests. The package integrates with class-validator for input validation. However, versions prior to v0.26.0 are vulnerable to a validation bypass issue when using validators in the validators/ folder. This vulnerability can lead to improper handling of request bodies and queries, as well as false positives in input validation.
Vulnerability Detail
The validation bypass vulnerability in frourio occurs when certain request data is not properly validated. This can result in the execution of unauthorized actions or the acceptance of invalid input. Attackers can exploit this vulnerability to bypass security measures and potentially manipulate the application's behavior. The issue arises from a combination of the frourio framework, class-validator integration, and the use of validators in the validators/ folder.
How To Fix
Latest published version: 1.3.1 as of 23 Oct 2026
npm install frourio@1.3.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.26.0
This is the first release that contains the fix.
npm install frourio@0.26.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating frourio is not immediately feasible, there are two workarounds available. The first workaround is to manually validate objects from requests using class-transformer in controllers. This involves implementing custom validation logic to ensure the integrity of the input data. The second workaround is to disable the use of validators altogether. However, this may leave the application vulnerable to other types of input validation issues.
Conclusion
The validation bypass vulnerability in frourio can have serious security implications, allowing for unauthorized actions and acceptance of invalid input. It is crucial to update frourio to the latest version and install the necessary dependencies to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for frourio →
FAQ
Frourio is an npm package used for building web applications with TypeScript and Node.js. It provides a framework for creating APIs and handling HTTP requests.
The vulnerability allows for validation bypass in frourio, leading to improper handling of request data and false positives in input validation. This can potentially result in unauthorized actions and acceptance of invalid input.
To fix this vulnerability, update frourio to version v0.26.0 or later and install the class-transformer and reflect-metadata packages. These steps ensure proper input validation and prevent the validation bypass issue.
Yes, there are two workarounds. The first is to manually validate objects from requests using class-transformer in controllers. The second is to disable the use of validators, although this may introduce other input validation vulnerabilities.
You can find more information about this vulnerability, including discussions and updates, in the frourio GitHub repository.
