fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2021-05-19T21:15:28
Updated: 2024-08-03T22:11:06.350Z
Reserved: 2021-03-30T00:00:00
Link: CVE-2021-29624
Vulnrichment
No data.
NVD
Status : Modified
Published: 2021-05-19T22:15:07.837
Modified: 2024-11-21T06:01:31.150
Link: CVE-2021-29624
Redhat
No data.