CVE-2022-39287

tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-319

• https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317baPatch, Third Party Advisory
• https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6fThird Party Advisory
• https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317baPatch, Third Party Advisory
• https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6fThird Party Advisory

Published

Oct 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39281fat_free_crm is a an open source, Ruby on Rails customer rel…6.5
• CVE-2022-39282FreeRDP is a free remote desktop protocol library and client…7.5
• CVE-2022-39283FreeRDP is a free remote desktop protocol library and client…7.5
• CVE-2022-39284CodeIgniter is a PHP full-stack web framework. In versions p…4.3
• CVE-2022-39285ZoneMinder is a free, open source Closed-circuit television …5.4
• CVE-2022-39286Jupyter Core is a package for the core common functionality …8.8
• CVE-2022-39288fastify is a fast and low overhead web framework, for Node.j…7.5
• CVE-2022-39289ZoneMinder is a free, open source Closed-circuit television …7.5
• CVE-2022-3929 Communication between the client and the server application…9.8
• CVE-2022-39290ZoneMinder is a free, open source Closed-circuit television …6.5
• CVE-2022-39291ZoneMinder is a free, open source Closed-circuit television …5.4
• CVE-2022-39292Slack Morphism is a modern client library for Slack Web/Even…7.5