CVE-2021-29624

fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.

• CWE-565
• CWE-352

• https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.htmlThird Party Advisory
• https://github.com/fastify/csrf/pull/2Patch, Third Party Advisory
• https://github.com/fastify/fastify-csrf/pull/51Patch, Third Party Advisory
• https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0Third Party Advisory
• https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8Patch, Third Party Advisory
• https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdfThird Party Advisory
• https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.htmlThird Party Advisory
• https://github.com/fastify/csrf/pull/2Patch, Third Party Advisory
• https://github.com/fastify/fastify-csrf/pull/51Patch, Third Party Advisory
• https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0Third Party Advisory
• https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8Patch, Third Party Advisory
• https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdfThird Party Advisory

Published

May 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29618TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-29619TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-29620Report portal is an open source reporting and analysis frame…7.5
• CVE-2021-29621Flask-AppBuilder is a development framework, built on top of…5.3
• CVE-2021-29622Prometheus is an open-source monitoring system and time seri…6.1
• CVE-2021-29623Exiv2 is a C++ library and a command-line utility to read, w…3.3
• CVE-2021-29625Adminer is open-source database management software. A cross…6.1
• CVE-2021-29626In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r3…5.5
• CVE-2021-29627In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r3…7.8
• CVE-2021-29628In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STA…7.5
• CVE-2021-29629In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STA…7.5
• CVE-2021-29630In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STA…8.1