high7.5
CVE-2018-3711
Denial of Service vulnerability with large JSON payloads in fastify
Impact
Affected versions of `fastify` are vulnerable to a denial of service when processing a request with `Content-Type` set to `application/json` and a very large payload. ## Recommendation Update to version 0.38.0 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | fastify | <= 0.37.0 | 0.38.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fastify | Fastify | before 0.38.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/fastify/fastify/pull/627
- https://hackerone.com/reports/303632
- https://github.com/advisories/GHSA-mq6c-fh97-4gwv
- https://nvd.nist.gov/vuln/detail/CVE-2018-3711
- https://github.com/fastify/fastify/commit/fabd2a011f2ffbb877394abe699f549513ffbd76
- https://www.npmjs.com/advisories/564