{"action":"Upgrade @fastify/csrf-protection to 4.1.0 or later.","affected":[{"fixed":"4.1.0","introduced":"0"},{"fixed":"6.3.0","introduced":"5.0.0"}],"component":"@fastify/csrf-protection","cve_ids":["CVE-2023-27495"],"ecosystem":"npm","epss":0.00331,"exploited":false,"fixed_versions":["4.1.0","6.3.0"],"ghsa_id":"GHSA-qrgf-9gpc-vrxw","id":"tcs_01M5KG71FR16516KQH64959VMB","modified_at":"2026-09-10T03:49:57.077390149Z","published_at":"2023-04-20T21:18:51Z","references":["https://osv.dev/vulnerability/GHSA-qrgf-9gpc-vrxw","https://github.com/fastify/csrf-protection/security/advisories/GHSA-qrgf-9gpc-vrxw","https://github.com/fastify/csrf-protection/security/advisories/GHSA-rc4q-9m69-gqp8","https://nvd.nist.gov/vuln/detail/CVE-2023-27495","https://github.com/fastify/csrf-protection/commit/be3e5761f37aa05c7c1ac8ed44499c51ecec8058","https://github.com/fastify/csrf-protection","https://github.com/fastify/csrf-protection/releases/tag/v4.1.0","https://github.com/fastify/csrf-protection/releases/tag/v6.3.0","https://www.cvedetails.com/cve/CVE-2021-29624"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-qrgf-9gpc-vrxw","url":"https://osv.dev/vulnerability/GHSA-qrgf-9gpc-vrxw"}],"summary":"Bypass of CSRF protection in the presence of predictable userInfo"}