CVE-2022-39288

    Dashboard / Vulnerabilities / CVE-2022-39288

    CVE-2022-39288

    Published: 10 Oct 2022Last Modified: 12 Aug 2026

    Summary: Denial of service in Fastify via Content-Type header

    Details: fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause the application to crash. This issue has been addressed in commit `fbb07e8d` and will be included in release version 4.8.1. Users are advised to upgrade. Users unable to upgrade may manually filter out http content with malicious Content-Type headers.

    References: https://github.com/fastify/fastify/security/policy, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39288.json, https://github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rg, https://nvd.nist.gov/vuln/detail/CVE-2022-39288, https://github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e941c24bf51af7184cf658ca138e069e8c166ef8
    Fixed -6b2aff6c6808bdc162b461ce68c025e00c58e878

    Affected versions

    v4.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39288 | CVE-DB