Fastify version 5.2.2, a minor update to the fast and low-overhead Node.js web framework, introduces key improvements and dependency updates catered to developers seeking enhanced performance and security. One notable change is the updated borp devDependency from version 0.18.0 to 0.19.0 which may include bug fixes and some performance improvements. The autocannon dependency has been upgraded from 7.15.0 to 8.0.0, likely bringing improvements in HTTP benchmarking capabilities, crucial for performance testing. TypeScript also sees an important update, moving from version ~5.4.5 to ~5.8.2, offering developers access to the latest language features, bug fixes, and improved type checking.
Significant upgrades are seen in code linting and style tools: @stylistic/eslint-plugin and @stylistic/eslint-plugin-js jump from version 2.1.0 to 4.1.0. These updates ensure code adheres to modern style guidelines, promoting readability and maintainability. Similarly, markdownlint-cli2 advances from 0.13.0 to 0.17.1 helping keep documentation clean and consistent. Also worthwhile is the update of the neostandard dependency from 0.11.3 to 0.12.0, plus the update to the concurrently dependency which now sits at version 9.1.2 instead of 8.2.2. The dist section indicates a slight reduction in the unpacked size from 2572065 to 2567846, and a small increase of file count from 347 to 350 which suggests optimized package structure. Note finally that this is not only a quality of life release as it also addresses potential security vulnerabilities by bumping versions through a few dependencies.
All the vulnerabilities related to the version 5.2.2 of the package
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
In applications that specify different validation strategies for different content types, it's possible to bypass the validation by providing a slightly altered content type such as with different casing or altered whitespacing before ;.
Users using the the following pattern are affected:
fastify.post('/', {
handler(request, reply) {
reply.code(200).send(request.body)
},
schema: {
body: {
content: {
'application/json': {
schema: {
type: 'object',
properties: {
'foo': {
type: 'string',
}
},
required: ['foo']
}
},
}
}
}
})
User using the following pattern are not affected:
fastify.post('/', {
handler(request, reply) {
reply.code(200).send(request.body)
},
schema: {
body: {
type: 'object',
properties: {
'foo': {
type: 'string',
}
},
required: ['foo']
}
}
})
This was patched in v5.3.1, but unfortunately it did not cover all problems. This has been fully patched in v5.3.2. Version v4.9.0 was also affected by this issue. This has been fully patched in v4.9.1.
Do not specify multiple content types in the schema.
Are there any links users can visit to find out more?
https://hackerone.com/reports/3087928