{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T17:30:15.515","vulnerabilities":[{"cve":{"id":"CVE-2021-29624","sourceIdentifier":"security-advisories@github.com","published":"2021-05-19T22:15:07.837","lastModified":"2024-11-21T06:01:31.150","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a \"double submit\" mechanism using cookies with an application deployed across multiple subdomains, e.g. \"heroku\"-style platform as a service. Version 3.1.0 of the fastify-csrf fixes it. the vulnerability. The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains."},{"lang":"es","value":"fastify-csrf es un plugin de código abierto que ayuda a desarrolladores a proteger su servidor Fastify contra ataques de tipo CSRF. Las versiones de fastify-csrf anterior a versión 3.1.0, presentan un mecanismo de \"double submit\" usando cookies con una aplicación implementada en múltiples subdominios, por ejemplo, una plataforma de estilo \"heroku\" como servicio. La versión 3.1.0 de fastify-csrf corrige la vulnerabilidad. El usuario del módulo necesitaría suministrar un \"userInfo\" cuando se genera el token de tipo CSRF para implementar completamente la protección en su extremo. Esto solo es necesario para aplicaciones alojadas en diferentes subdominios"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-565"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fastify:fastify-csrf:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.1.0","matchCriteriaId":"0F5A2AFF-5DF3-40ED-B043-5D581FC7E05E"}]}]}],"references":[{"url":"https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/fastify/csrf/pull/2","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/fastify/fastify-csrf/pull/51","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/fastify/csrf/pull/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/fastify/fastify-csrf/pull/51","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/fastify/fastify-csrf/releases/tag/v3.1.0","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/fastify/fastify-csrf/security/advisories/GHSA-rc4q-9m69-gqp8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}