Skip to content

chore(fastify): Update dependency fastify to v5.3.2 [SECURITY] #5667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 18, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
fastify (source) 5.0.0 -> 5.3.2 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-32442

Impact

In applications that specify different validation strategies for different content types, it's possible to bypass the validation by providing a slightly altered content type such as with different casing or altered whitespacing before ;.

Users using the the following pattern are affected:

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      content: {
        'application/json': {
          schema: {
            type: 'object',
            properties: {
              'foo': {
                type: 'string',
              }
            },
            required: ['foo']
          }
        },
      }
    }
  }
})

User using the following pattern are not affected:

fastify.post('/', {
  handler(request, reply) {
    reply.code(200).send(request.body)
  },
  schema: {
    body: {
      type: 'object',
      properties: {
        'foo': {
          type: 'string',
        }
      },
      required: ['foo']
    }
  }
})

Patches

This was patched in v5.3.1, but unfortunately it did not cover all problems. This has been fully patched in v5.3.2.

Workarounds

Do not specify multiple content types in the schema.

References

Are there any links users can visit to find out more?

https://hackerone.com/reports/3087928


Release Notes

fastify/fastify (fastify)

v5.3.2

Compare Source

v5.3.1

Compare Source

v5.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.2.2...v5.3.0

v5.2.2

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.2.1...v5.2.2

v5.2.1

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.2.0...v5.2.1

v5.2.0

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.1.0...v5.2.0

v5.1.0

Compare Source

What's Changed
New Contributors

Full Changelog: fastify/fastify@v5.0.0...v5.1.0


Configuration

📅 Schedule: Branch creation - "" in timezone GMT, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

vercel bot commented Apr 18, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
clerk-js-sandbox ✅ Ready (Inspect) Visit Preview 💬 Add feedback Apr 24, 2025 6:01pm

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Apr 18, 2025
@renovate renovate bot enabled auto-merge (squash) April 18, 2025 15:40
Copy link

changeset-bot bot commented Apr 18, 2025

⚠️ No Changeset found

Latest commit: 7b936c5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from d1d59f7 to 2cb4293 Compare April 18, 2025 18:21
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 2cb4293 to 232ecf2 Compare April 18, 2025 20:15
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 232ecf2 to bc72892 Compare April 18, 2025 22:01
@renovate renovate bot changed the title chore(fastify): Update dependency fastify to v5.3.1 [SECURITY] chore(fastify): Update dependency fastify to v5.3.2 [SECURITY] Apr 18, 2025
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from bc72892 to 3d3f8c0 Compare April 18, 2025 22:47
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 3d3f8c0 to f62edc8 Compare April 21, 2025 14:58
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from f62edc8 to 718c9a8 Compare April 21, 2025 18:01
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 718c9a8 to 39c9a0e Compare April 21, 2025 18:19
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 39c9a0e to 35bd777 Compare April 21, 2025 20:43
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 35bd777 to 2670a83 Compare April 21, 2025 23:02
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 2670a83 to 796d143 Compare April 22, 2025 00:43
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 796d143 to 08f88d9 Compare April 22, 2025 11:14
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 08f88d9 to 86cf03d Compare April 22, 2025 13:54
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 88c6463 to 545156e Compare April 23, 2025 19:06
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 545156e to 1db0888 Compare April 23, 2025 20:53
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 1db0888 to 857eccd Compare April 23, 2025 21:34
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 857eccd to ccbbc62 Compare April 24, 2025 07:05
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from ccbbc62 to 2a57cee Compare April 24, 2025 07:20
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 2a57cee to ab8021e Compare April 24, 2025 08:42
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from ab8021e to b7378bd Compare April 24, 2025 13:13
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from b7378bd to a58be49 Compare April 24, 2025 13:30
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from a58be49 to d6c954a Compare April 24, 2025 13:33
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from d6c954a to 7f4448d Compare April 24, 2025 14:13
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 7f4448d to e535bc0 Compare April 24, 2025 14:50
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from e535bc0 to 9d98152 Compare April 24, 2025 16:06
@renovate renovate bot force-pushed the renovate/npm-fastify-vulnerability branch from 9d98152 to 0113608 Compare April 24, 2025 16:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants