CVE-2022-39288

fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause the application to crash. This issue has been addressed in commit `fbb07e8d` and will be included in release version 4.8.1. Users are advised to upgrade. Users unable to upgrade may manually filter out http content with malicious Content-Type headers.

• CWE-754

• https://github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3Patch, Third Party Advisory
• https://github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rgMitigation, Third Party Advisory
• https://github.com/fastify/fastify/security/policyThird Party Advisory
• https://github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3Patch, Third Party Advisory
• https://github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rgMitigation, Third Party Advisory
• https://github.com/fastify/fastify/security/policyThird Party Advisory

Published

Oct 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39282FreeRDP is a free remote desktop protocol library and client…7.5
• CVE-2022-39283FreeRDP is a free remote desktop protocol library and client…7.5
• CVE-2022-39284CodeIgniter is a PHP full-stack web framework. In versions p…4.3
• CVE-2022-39285ZoneMinder is a free, open source Closed-circuit television …5.4
• CVE-2022-39286Jupyter Core is a package for the core common functionality …8.8
• CVE-2022-39287tiny-csrf is a Node.js cross site request forgery (CSRF) pro…6.5
• CVE-2022-39289ZoneMinder is a free, open source Closed-circuit television …7.5
• CVE-2022-3929 Communication between the client and the server application…9.8
• CVE-2022-39290ZoneMinder is a free, open source Closed-circuit television …6.5
• CVE-2022-39291ZoneMinder is a free, open source Closed-circuit television …5.4
• CVE-2022-39292Slack Morphism is a modern client library for Slack Web/Even…7.5
• CVE-2022-39293Azure RTOS USBX is a high-performance USB host, device, and …9.8