CVE-2020-8192 - A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas

Back Back to CVE browser

MEDIUM

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas

Published Jul 30, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 1.16%

Description

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.

Affected products

Vendor n/a Product Fastify Default
n/a
- Version
  Fixed in v2.15.1 and v3.0.0-rc.5. v1 not affected.
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Fastify

n/a

Version	Status	Constraints
Fixed in v2.15.1 and v3.0.0-rc.5. v1 not affected.	affected	-

Ecosystem	Package	Introduced	Fixed
npm	fastify	0	2.15.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (4)

https://github.com/advisories/GHSA-xw5p-hw6r-2j98
Advisory
https://github.com/fastify/fastify/commit/74c3157ca90c3ffed9e4434f63c2017471ec970e
https://hackerone.com/reports/903521
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8192

Link	Providers	Tags
https://github.com/advisories/GHSA-xw5p-hw6r-2j98		Advisory
https://github.com/fastify/fastify/commit/74c3157ca90c3ffed9e4434f63c2017471ec970e
https://hackerone.com/reports/903521		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8192