Most recent entries from all

EUVD-2026-169230

2026-10-06T10:38:29.863533+00:00

EUVD-2026-169230

fkie_cve-2020-28482

2026-10-06T10:38:29.863583+00:00

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter

GHSA-49wp-qq6x-g2rf — Cross-site Request Forgery in fastify-csrf

2026-10-06T10:38:29.863635+00:00

Affected: npm: fastify-csrf

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: `cookieOpts: { path: '/', sameSite: true }` 2. The CSRF token was available in the GET query parameter

gsd-2020-28482

2026-10-06T10:38:29.863663+00:00

gsd-2020-28482