CVE-2022-39386 - CVE House
Back to Database
Status published High CVE-2022-39386

fastify-websocket vulnerable to uncaught exception via crash on malformed packet

Vulnerability Description

@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39386

Credits & Attribution

No credits recorded in the NVD database.

References

More from fastify

View All →
CVE-2025-66415
fastify-reply-from bypass of reply forwarding
Medium 6.9
CVE-2025-32442
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
High 7.5
CVE-2025-24033
@fastify/multipart vulnerable to unlimited consumption of resources
High 7.5
CVE-2024-35220
@fastify/session reuses destroyed session cookie
High 7.4
CVE-2024-31999
@fastify/secure-session: Reuse of destroyed secure session cookie
High 7.4

Affected Vendor

Affected Software

fastify-websocket
Vulnerable Versions:
>= 5.0.0, < 5.0.1, >= 6.0.0, < 7.1.1, <= 4.3.0

Timeline

Official Publish: November 8th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-248

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499.003 Application Exhaustion Flood
Impact