CVE-2020-28482

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter

• CWE-200
• CWE-732

• https://github.com/fastify/fastify-csrf/pull/26Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-FASTIFYCSRF-1062044Third Party Advisory
• https://github.com/fastify/fastify-csrf/pull/26Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-FASTIFYCSRF-1062044Third Party Advisory

Published

Jan 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28477This affects all versions of package immer.7.5
• CVE-2020-28478This affects the package gsap before 3.6.0.7.5
• CVE-2020-28479The package jointjs before 3.3.0 are vulnerable to Denial of…7.5
• CVE-2020-2848Vulnerability in the Oracle Depot Repair product of Oracle E…8.2
• CVE-2020-28480The package jointjs before 3.3.0 are vulnerable to Prototype…9.8
• CVE-2020-28481The package socket.io before 2.4.0 are vulnerable to Insecur…4.3
• CVE-2020-28483This affects all versions of package github.com/gin-gonic/gi…7.1
• CVE-2020-28487This affects the package vis-timeline before 7.4.4. An attac…6.8
• CVE-2020-28488Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-2849Vulnerability in the Oracle Depot Repair product of Oracle E…8.2
• CVE-2020-28490The package async-git before 1.13.2 are vulnerable to Comman…9.8
• CVE-2020-28491This affects the package com.fasterxml.jackson.dataformat:ja…7.5