CVE-2023-27495
1 advisory.
npm/@fastify/csrf-protection CVE-2023-27495: medium 5.3, EPSS 0.33%
Bypass of CSRF protection in the presence of predictable userInfo
Action: Upgrade @fastify/csrf-protection to 4.1.0 or later.
npm i @fastify/csrf-protection@4.1.0npm i @fastify/csrf-protection@6.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.1.0 | - |
| 5.0.0 | 6.3.0 | - |
Fixed versions
| 4.1.0 | 6.3.0 |
Sources
- osv: GHSA-qrgf-9gpc-vrxw
- https://github.com/fastify/csrf-protection/security/advisories/GHSA-qrgf-9gpc-vrxw
- https://github.com/fastify/csrf-protection/security/advisories/GHSA-rc4q-9m69-gqp8
- https://nvd.nist.gov/vuln/detail/CVE-2023-27495
- https://github.com/fastify/csrf-protection/commit/be3e5761f37aa05c7c1ac8ed44499c51ecec8058
- https://github.com/fastify/csrf-protection
- https://github.com/fastify/csrf-protection/releases/tag/v4.1.0
- https://github.com/fastify/csrf-protection/releases/tag/v6.3.0
- https://www.cvedetails.com/cve/CVE-2021-29624
CVE-2023-27495 · published · modified · JSON