CVE-2021-32677: Cross-Site Request Forgery (CSRF) in FastAPI
Summary
CVE-2021-32677: Cross-Site Request Forgery (CSRF) in FastAPI. Affects fastapi versions < 0.65.2. Fixed in 0.65.2. How to fix ↓
Also tracked for
- fastapi · Debian:11
The same CVE-2021-32677 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FastAPI is a Python web framework used for building APIs with high performance and easy development. It allows developers to create robust and scalable applications quickly. However, versions lower than 0.65.2 that used cookies for authentication in path operations accepting JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack.
Vulnerability Detail
The vulnerability in FastAPI versions lower than 0.65.2 allowed requests with a content type of 'text/plain' containing JSON data to be accepted and processed. This was possible because FastAPI would try to read the request payload as JSON even if the 'content-type' header was not set to 'application/json' or a compatible JSON media type. As a result, a malicious attacker could craft a request that would execute in the user's browser, including any associated cookies. This could lead to unauthorized actions being performed on behalf of the user.
How To Fix
Latest published version: 0.161.1 as of 23 Oct 2026
pip install --upgrade "fastapi==0.161.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.65.2
This is the first release that contains the fix.
pip install --upgrade "fastapi==0.65.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest FastAPI version is not immediately feasible, a temporary workaround can be implemented by adding a middleware or a dependency that checks the 'content-type' header and aborts the request if it is not 'application/json' or another compatible JSON content type. This can help prevent the vulnerability from being exploited.
Conclusion
In conclusion, FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations accepting JSON payloads sent by browsers were vulnerable to a CSRF attack. It is crucial to upgrade to the latest FastAPI version or implement the recommended workaround to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fastapi →
FAQ
FastAPI is a Python web framework used for building high-performance APIs with ease.
Versions lower than 0.65.2 that use cookies for authentication in path operations accepting JSON payloads sent by browsers are affected.
A CSRF attack is an attack that tricks the victim into submitting a malicious request. In this case, the attacker can craft a request that executes in the user's browser, potentially leading to unauthorized actions.
The recommended fix is to upgrade to FastAPI version 0.65.2 or higher. Alternatively, you can implement a workaround by checking the 'content-type' header and aborting requests that are not 'application/json' or a compatible JSON content type.
You can refer to the OWASP CSRF page (https://owasp.org/www-community/attacks/csrf) for more information on CSRF attacks and how to prevent them.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastapi.
