Description

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.

Remediation

References

https://hackerone.com/reports/903521

Related Vulnerabilities

CVE-2021-43142 Vulnerability in maven package com.wutka:jox

CVE-2020-26256 Vulnerability in npm package fast-csv

CVE-2018-11011 Vulnerability in maven package cc.ryanc:halo

CVE-2021-27582 Vulnerability in maven package org.mitre:openid-connect-server

CVE-2020-5284 Vulnerability in npm package next

Severity

High

Classification

CWE-400 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Exploit Third Party Advisory