Vulnerabilities in pkg:npm/@fastify/websocket

PACKAGE
Advisory Identifier: GHSA-4pcg-wr6c-h9cq
Share
Advisory Summary

CVE-2022-39386 is a HIGH (CVSS 7.5) fastify/websocket vulnerable to uncaught exception vulnerability (CWE-248: Uncaught Exception) affecting @fastify/websocket libraries in the npm ecosystem. The issue involves fastify/websocket vulnerable to uncaught exception via crash on malformed packet. Remediation is available by upgrading affected packages to version 5.0.1, 7.1.1.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:npm/@fastify/websocket

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:npm/@fastify/websocket. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-4pcg-wr6c-h9cq CVE-2022-39386 HIGH fastify/websocket vulnerable to uncaught exception via crash on malformed packet

CVE-2022-39386 at a Glance

CVE Identifier CVE-2022-39386
GHSA Identifier GHSA-4pcg-wr6c-h9cq
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification CWE-248: Uncaught Exception
Affected Product @fastify/websocket
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2022-39386

To remediate this vulnerability, upgrade all affected @fastify/websocket dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@fastify/websocket fixed: 5.0.1 
npm install @fastify/websocket@5.0.1
@fastify/websocket fixed: 7.1.1 
npm install @fastify/websocket@7.1.1
fastify-websocket fixed: Latest secure release 
npm install fastify-websocket@Latest secure release
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @fastify/websocket

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2022-39386, inspect your project dependencies using npm:

npm ls @fastify/websocket

Analyze the terminal output to locate any version of @fastify/websocket in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.0.1), your application is affected.

Note: The npm ls @fastify/websocket command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-248: Uncaught Exception, where an exception is thrown from a function, but it is not caught. In @fastify/websocket, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. ### Patches This has been patched in v7.1.1 (fastify v4) and v5.0.1 (fastify v3). ### Workarounds No known workaround is available. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions. ## Credits [marcolanaro](https://github.com/marcolanaro) for finding and patching this vulnerability ### For more information If you have any questions or comments about this advisory: * Open an issue in [@fastify/websocket](https://github.com/fastify/fastify-websocket) * Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)

CVE-2022-39386 Affected @fastify/websocket Versions

3 component(s)
Fixed Versions:
5.0.17.1.1
Product / Package Ecosystem Affected Versions Fixed Version
@fastify/websocket
npm/@fastify/websocket
npm
≥ 5.0.0
< 5.0.1
5.0.1
@fastify/websocket
npm/@fastify/websocket
npm
≥ 6.0.0
< 7.1.1
7.1.1
fastify-websocket
npm/fastify-websocket
npm
≤ 4.3.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/fastify/fastify-websocket/security/advisories/GHSA-4pcg-wr6c-h9cq
NVD — CVE-2022-39386 NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39386
@fastify/websocket Source Repository REPOSITORY
https://github.com/fastify/fastify-websocket/pull/228
Security Fix Commit FIX COMMIT
https://github.com/fastify/fastify-websocket/commit/7e8c41a51c101c3d5ce88caee4f71d9c29eb2863
Security Fix Commit FIX COMMIT
https://github.com/fastify/fastify-websocket/commit/c24adeb3efd57a18b2f287c35d029e88b5a47194
@fastify/websocket Source Repository REPOSITORY
https://github.com/fastify/fastify-websocket
@fastify/websocket Release RELEASE
https://github.com/fastify/fastify-websocket/releases/tag/v5.0.1
@fastify/websocket Release RELEASE
https://github.com/fastify/fastify-websocket/releases/tag/v7.1.1

Frequently Asked Questions

What is CVE-2022-39386?
CVE-2022-39386 is a security vulnerability in @fastify/websocket involving fastify/websocket vulnerable to uncaught exception via crash on malformed packet under CWE-248: Uncaught Exception.
Which @fastify/websocket versions are affected?
Affected versions include releases prior to 5.0.1, 7.1.1 across affected packages: @fastify/websocket, fastify-websocket.
What version fixes CVE-2022-39386?
Upgrading to 5.0.1, 7.1.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @fastify/websocket affected?
Yes, @fastify/websocket is affected in releases prior to 5.0.1, 7.1.1. Upgrade your dependency to 5.0.1, 7.1.1 or later.
Is fastify-websocket affected?
Yes, fastify-websocket is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What is the CVSS score of CVE-2022-39386?
CVE-2022-39386 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2022-39386?
CVE-2022-39386 is classified under CWE-248: Uncaught Exception (An exception is thrown from a function, but it is not caught.).
How can I check npm dependencies for CVE-2022-39386?
Run the dependency tree command: 'npm ls @fastify/websocket'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4pcg-wr6c-h9cq",
  "modified" : "2022-11-07T21:13:57Z",
  "published" : "2022-11-07T21:13:57Z",
  "aliases" : [ "CVE-2022-39386" ],
  "summary" : "fastify/websocket vulnerable to uncaught exception via crash on malformed packet",
  "details" : "### Impact\n\nAny application using @fastify/websocket could crash if a specific, malformed packet is sent. \n\nAll versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched.\n\n### Patches\n\nThis has been patched in v7.1.1 (fastify v4) and v5.0.1 (fastify v3).\n\n### Workarounds\n\nNo known workaround is available. However, it should be possible to attach the error handler manually.\nThe recommended path is upgrading to the patched versions.\n\n## Credits\n\n[marcolanaro](https://github.com/marcolanaro) for finding and patching this vulnerability\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [@fastify/websocket](https://github.com/fastify/fastify-websocket)\n* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@fastify/websocket"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.0.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@fastify/websocket"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.0.0"
      }, {
        "fixed" : "7.1.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "fastify-websocket"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "4.3.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fastify-websocket/security/advisories/GHSA-4pcg-wr6c-h9cq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-39386"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fastify-websocket/pull/228"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fastify-websocket/commit/7e8c41a51c101c3d5ce88caee4f71d9c29eb2863"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fastify-websocket/commit/c24adeb3efd57a18b2f287c35d029e88b5a47194"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/fastify/fastify-websocket"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fastify-websocket/releases/tag/v5.0.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/fastify-websocket/releases/tag/v7.1.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-248" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-11-07T21:13:57Z",
    "nvd_published_at" : "2022-11-08T22:15:00Z"
  }
}