Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency fastify to v4.10.2 [security] #11

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency fastify to v4.10.2 [security] #11

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 11, 2022 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
fastify (source) 4.3.0 -> 4.10.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-39288

Impact

An attacker can send an invalid Content-Type header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected.

(This was updated: upon a close inspection, v3.x is not affected after all).

Patches

Yes, update to > v4.8.0.

Workarounds

You can reject the malicious content types before the body parser enters in action.

  const badNames = Object.getOwnPropertyNames({}.__proto__)
  fastify.addHook('onRequest', async (req, reply) => {
    for (const badName of badNames) {
      if (req.headers['content-type'].indexOf(badName) > -1) {
        reply.code(415)
        throw new Error('Content type not supported')
      }
    }
  })

References

See the HackerOne report #​1715536

For more information

Fastify security policy

CVE-2022-41919

Impact

The attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack.

Patches

For 4.x users, please update to at least 4.10.2
For 3.x users, please update to at least 3.29.4

Workarounds

Implement Cross-Site Request Forgery protection using @fastify/csrf.

References

Check out the HackerOne report: https://hackerone.com/reports/1763832.

For more information

Fastify security policy

Release Notes

fastify/fastify (fastify)

v4.10.2

Compare Source

⚠️ Security Release ⚠️

Full Changelog: fastify/fastify@v4.10.1...v4.10.2

v4.10.1

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v4.10.0...v4.10.1

v4.10.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v4.9.2...v4.10.0

v4.9.2

Compare Source

What's Changed

Full Changelog: fastify/fastify@v4.9.1...v4.9.2

v4.9.1

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v4.9.0...v4.9.1

v4.9.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v4.8.1...v4.9.0

v4.8.1

Compare Source

⚠️ Security Release ⚠️

This release fixes GHSA-455w-c45v-86rg for the v4.x line.
This is a HIGH vulnerability that can lead to a crash, resulting in a total loss of availability.
The CVE for this vulnerability is CVE-2022-39288.

Full Changelog: fastify/fastify@v4.8.0...v4.8.1

v4.8.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v4.7.0...v4.8.0

v4.7.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v4.6.0...v4.7.0

v4.6.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v4.5.3...v4.6.0

v4.5.3

Compare Source

What's Changed

Full Changelog: fastify/fastify@v4.5.2...v4.5.3

v4.5.2

Compare Source

What's Changed

Full Changelog: fastify/fastify@v4.5.1...v4.5.2

v4.5.1

Compare Source

What's Changed

Full Changelog: fastify/fastify@v4.5.0...v4.5.1

v4.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v4.4.0...v4.5.0

v4.4.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v4.3.0...v4.4.0

Configuration

📅 Schedule: Branch creation - "" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot changed the title chore(deps): update dependency fastify to 4.8.1 [security] chore(deps): update dependency fastify to 4.10.2 [security] Mar 18, 2023
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from d60ca18 to 9f72d55 Compare March 18, 2023 12:04
@renovate renovate bot changed the title chore(deps): update dependency fastify to 4.10.2 [security] chore(deps): update dependency fastify to v4.10.2 [security] Mar 25, 2023
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 9f72d55 to 3b19bd0 Compare April 3, 2023 10:57
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 3b19bd0 to caaa401 Compare April 17, 2023 12:56
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from caaa401 to d5c2860 Compare May 28, 2023 12:20
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from d5c2860 to 39e49cd Compare October 19, 2023 15:02
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 39e49cd to 2656ce2 Compare November 30, 2023 16:33
@renovate renovate bot requested a review from trevor-scheer as a code owner November 30, 2023 16:33
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 2656ce2 to d72a0a7 Compare January 30, 2024 12:52
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Feb 4, 2024 •
edited
Loading

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: [email protected]
npm ERR! Found: [email protected]
npm ERR! node_modules/fastify
npm ERR!   dev fastify@"4.3.0" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer fastify@"4.10.2" from [email protected]
npm ERR! packages/fastify
npm ERR!   [email protected]
npm ERR!   node_modules/apollo-server-integration-fastify
npm ERR!     workspace packages/fastify from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: [email protected]
npm ERR! node_modules/fastify
npm ERR!   peer fastify@"4.10.2" from [email protected]
npm ERR!   packages/fastify
npm ERR!     [email protected]
npm ERR!     node_modules/apollo-server-integration-fastify
npm ERR!       workspace packages/fastify from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! 
npm ERR! For a full report see:
npm ERR! /tmp/renovate/cache/others/npm/_logs/2024-04-25T08_58_32_860Z-eresolve-report.txt

npm ERR! A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2024-04-25T08_58_32_860Z-debug-0.log

@renovate Renovate
Copy link
Contributor Author

renovate bot commented Jun 4, 2024 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: [email protected]
npm error Found: [email protected]
npm error node_modules/fastify
npm error   dev fastify@"4.3.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer fastify@"4.10.2" from [email protected]
npm error packages/fastify
npm error   [email protected]
npm error   node_modules/apollo-server-integration-fastify
npm error     workspace packages/fastify from the root project
npm error
npm error Conflicting peer dependency: [email protected]
npm error node_modules/fastify
npm error   peer fastify@"4.10.2" from [email protected]
npm error   packages/fastify
npm error     [email protected]
npm error     node_modules/apollo-server-integration-fastify
npm error       workspace packages/fastify from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /tmp/renovate/cache/others/npm/_logs/2025-02-09T13_29_01_754Z-eresolve-report.txt
npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2025-02-09T13_29_01_754Z-debug-0.log

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@trevor-scheer trevor-scheer Awaiting requested review from trevor-scheer trevor-scheer is a code owner

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
🎄 dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants