CVE-2022-39386: fastify-websocket vulnerable to uncaught exception via crash on malformed packet
@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39386?
CVE-2022-39386 has been classified as high severity due to the potential crash of applications using @fastify/websocket.
How do I fix CVE-2022-39386?
CVE-2022-39386 cannot be fixed since the @fastify/websocket module is deprecated and will not receive a patch.
Which versions of Fastify Websocket are affected by CVE-2022-39386?
All versions of Fastify Websocket, including those between 6.0.0 and 7.1.1 and 5.0.0, are affected by CVE-2022-39386.
What is the main risk associated with CVE-2022-39386?
The main risk associated with CVE-2022-39386 is that an application can crash upon receiving a specific, malformed WebSocket packet.
Is there a recommended alternative to @fastify/websocket due to CVE-2022-39386?
Due to the deprecation of @fastify/websocket, it is advisable to look for alternative WebSocket libraries that are actively maintained and secure.