CVE-2022-41919: Fastify Incorrect Content-Type Parsing CSRF Attack
Summary
CVE-2022-41919: Fastify: Incorrect Content-Type parsing can lead to CSRF attack. Affects fastify across 2 version ranges.
>= 3.0.0, < 3.29.4
>= 4.0.0, < 4.10.2
Fixed in 3.29.4 or 4.10.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is an open-source web framework for Node.js that focuses on providing high performance and low overhead. It is designed to be highly extensible and developer-friendly, making it a popular choice for building web applications. However, a vulnerability has been discovered in Fastify that allows for an incorrect parsing of the Content-Type header, which can lead to a Cross-Site Request Forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in Fastify arises from the incorrect parsing of the Content-Type header. This allows an attacker to bypass the Pre-Flight checking of fetch requests. By sending a fetch() request with a Content-Type that matches the essence of 'application/x-www-form-urlencoded', 'multipart/form-data', or 'text/plain', the attacker can invoke routes that only accept 'application/json' content type. This bypasses any Cross-Origin Resource Sharing (CORS) protection and enables a CSRF attack.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.29.43.29.4npm install fastify@3.29.4 -
>= 4.0.0, < 4.10.24.10.2npm install fastify@4.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, Fastify users can implement Cross-Site Request Forgery protection using the '@fastify/csrf' package. This package provides middleware that adds CSRF tokens to requests and validates them to prevent CSRF attacks. By implementing this protection, users can mitigate the risk of CSRF attacks even if they are using an older version of Fastify.
Conclusion
In conclusion, the Fastify Incorrect Content-Type Parsing vulnerability can lead to a CSRF attack by bypassing CORS protection. Fastify users should update to the recommended versions to fix this vulnerability. Alternatively, implementing Cross-Site Request Forgery protection using the '@fastify/csrf' package can provide mitigation for users on older versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fastify →
FAQ
Fastify is an open-source web framework for Node.js that focuses on providing high performance and low overhead. It is designed to be highly extensible and developer-friendly.
A CSRF (Cross-Site Request Forgery) attack is an attack that tricks the victim into performing unwanted actions on a website in which they are authenticated. It occurs when an attacker can make a victim's browser send a malicious request to a target website without the victim's knowledge or consent.
The Fastify vulnerability allows for a CSRF attack by incorrectly parsing the Content-Type header. This allows an attacker to bypass the Pre-Flight checking of fetch requests and invoke routes that only accept 'application/json' content type, thus bypassing any CORS protection.
To fix the Fastify vulnerability, update to at least version 4.10.2 for Fastify 4.x or version 3.29.4 for Fastify 3.x. These versions address the incorrect Content-Type parsing issue.
Yes, a workaround for the Fastify vulnerability is to implement Cross-Site Request Forgery protection using the '@fastify/csrf' package. This package adds CSRF tokens to requests and validates them to prevent CSRF attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
