CVE-2022-39288 - CVE House
Back to Database
Status published High CVE-2022-39288

Denial of service in Fastify via Content-Type header

Vulnerability Description

fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause the application to crash. This issue has been addressed in commit `fbb07e8d` and will be included in release version 4.8.1. Users are advised to upgrade. Users unable to upgrade may manually filter out http content with malicious Content-Type headers.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39288

Credits & Attribution

No credits recorded in the NVD database.

References

More from fastify

View All →
CVE-2025-66415
fastify-reply-from bypass of reply forwarding
Medium 6.9
CVE-2025-32442
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
High 7.5
CVE-2025-24033
@fastify/multipart vulnerable to unlimited consumption of resources
High 7.5
CVE-2024-35220
@fastify/session reuses destroyed session cookie
High 7.4
CVE-2024-31999
@fastify/secure-session: Reuse of destroyed secure session cookie
High 7.4

Affected Vendor

Affected Software

fastify
Vulnerable Versions:
>= 4.0.0, < 4.8.1

Timeline

Official Publish: October 10th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-754

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1499 Endpoint Denial of Service
Impact
T1562 Impair Defenses
Defense Evasion
T1005 Data from Local System
Collection