CVE-2022-39288: fastify vulnerable to denial of service via malicious Content-Type
Summary
CVE-2022-39288: fastify vulnerable to denial of service via malicious Content-Type. Affects fastify versions >= 4.0.0, < 4.8.1. Fixed in 4.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is an open-source web framework for Node.js that is focused on providing high performance and low overhead. It is designed to be highly efficient and scalable, making it a popular choice for building web applications. However, a vulnerability has been discovered in Fastify versions 4.x that allows an attacker to send a malicious Content-Type header, leading to a possible Denial of Service attack. This vulnerability does not affect Fastify versions 3.x.
Vulnerability Detail
The vulnerability in Fastify arises from the handling of the Content-Type header. By sending an invalid Content-Type header, an attacker can cause the application to crash, resulting in a Denial of Service attack. This can disrupt the availability of the application and potentially impact its users. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.8.1
This is the first release that contains the fix.
npm install fastify@4.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Fastify is not immediately feasible, a temporary workaround can be implemented to reject the malicious content types before the body parser enters into action. The following code snippet demonstrates how to add a hook to reject the malicious content types:
const badNames = Object.getOwnPropertyNames({}.__proto__)
fastify.addHook('onRequest', async (req, reply) => {
for (const badName of badNames) {
if (req.headers['content-type'].indexOf(badName) > -1) {
reply.code(415)
throw new Error('Content type not supported')
}
}
})
Conclusion
In conclusion, Fastify versions 4.x are vulnerable to a denial of service attack through a malicious Content-Type header. It is crucial to update Fastify to version 4.8.1 or higher to mitigate this vulnerability. If immediate updating is not possible, implementing the provided workaround can help protect against potential attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fastify →
FAQ
The vulnerability allows an attacker to send a malicious Content-Type header, causing the application to crash and potentially leading to a Denial of Service attack. This can disrupt the availability of the application and impact its users.
Only Fastify versions 4.x are affected by this vulnerability. Versions 3.x are not vulnerable.
To fix this vulnerability, update Fastify to version 4.8.1 or higher. This update includes a patch that addresses the issue.
Yes, if updating Fastify is not immediately feasible, you can implement a workaround to reject the malicious content types before the body parser enters into action. Refer to the provided code snippet for more details.
You can find more information about this vulnerability in the HackerOne report https://hackerone.com/bugs?report_id=1715536&subject=fastify. Additionally, you can refer to the Fastify security policy for further details.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
