Skip to content

chore(deps): update dependency fastify to v5.3.2 [security] #237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: trunk
Choose a base branch
from
Open

chore(deps): update dependency fastify to v5.3.2 [security] #237

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Apr 18, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
fastify (source) 5.2.1 → 5.3.2 age confidence

GitHub Vulnerability Alerts

CVE-2025-32442

Impact

In applications that specify different validation strategies for different content types, it's possible to bypass the validation by providing a slightly altered content type such as with different casing or altered whitespacing before ;.

Users using the the following pattern are affected:

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      content: {
        'application/json': {
          schema: {
            type: 'object',
            properties: {
              'foo': {
                type: 'string',
              }
            },
            required: ['foo']
          }
        },
      }
    }
  }
})

User using the following pattern are not affected:

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      type: 'object',
      properties: {
        'foo': {
          type: 'string',
        }
      },
      required: ['foo']
    }
  }
})

Patches

This was patched in v5.3.1, but unfortunately it did not cover all problems. This has been fully patched in v5.3.2.
Version v4.9.0 was also affected by this issue. This has been fully patched in v4.9.1.

Workarounds

Do not specify multiple content types in the schema.

References

Are there any links users can visit to find out more?

https://hackerone.com/reports/3087928

Release Notes

fastify/fastify (fastify)

v5.3.2

Compare Source

⚠️ Security Release ⚠️

Unfortunately, v5.3.1 did not include a complete fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442. This is a follow-up patch to cover an edge case.

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.3.1...v5.3.2

v5.3.1

Compare Source

⚠️ Security Release ⚠️
What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.3.0...v5.3.1

v5.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.2.2...v5.3.0

v5.2.2

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.2.1...v5.2.2

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

@renovate renovate bot added dependencies Pull requests that update a dependency file security labels Apr 18, 2025
@renovate renovate bot assigned yyxi Apr 18, 2025
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 0a0df5d to b1d06b9 Compare April 18, 2025 22:51
@renovate renovate bot changed the title chore(deps): update dependency fastify to v5.3.1 [security] chore(deps): update dependency fastify to v5.3.2 [security] Apr 18, 2025
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from b1d06b9 to 404e838 Compare April 21, 2025 06:29
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 00789a3 to 55c9e5c Compare May 5, 2025 06:31
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 5ee3e59 to e8d0547 Compare May 12, 2025 15:35
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from e8d0547 to 310f921 Compare May 19, 2025 06:24
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from df866b2 to a392304 Compare June 2, 2025 05:52
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from a392304 to 1d42f4f Compare June 9, 2025 05:59
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 56f4b7e to 2d43875 Compare June 23, 2025 05:32
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from c1195e5 to 643bb24 Compare July 12, 2025 11:57
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 643bb24 to f92aadd Compare July 14, 2025 06:15
@socket-security
Copy link

socket-security bot commented Jul 14, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedfastify@​5.2.1 ⏵ 5.3.299 +1100 +1610094 -1100

View full report

@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from f92aadd to ba86a08 Compare July 21, 2025 05:15
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from ba86a08 to 677a607 Compare July 28, 2025 06:12
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 7bffc91 to 183b830 Compare August 18, 2025 04:55
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 183b830 to 3082139 Compare August 25, 2025 04:53
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch 2 times, most recently from 657ec0d to ba11acd Compare September 15, 2025 05:00
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from ba11acd to 039d49d Compare September 22, 2025 05:29
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 039d49d to 7d59d66 Compare September 29, 2025 06:02
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 7d59d66 to 10884c9 Compare October 13, 2025 05:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@yyxi yyxi

Labels

dependencies Pull requests that update a dependency file security

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@yyxi