What’s Vulnerable › Vulnerabilities

CVE-2018-3711

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-07 · updated 2026-06-17
• Weakness: CWE-770

Description

Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload.

Affected products

• fastify: before 0.38.0 — fixed in 0.38.0

How to fix

Upgrade to a fixed version: fastify 0.38.0. Check the vendor advisory for mitigations.

References

• https://github.com/fastify/fastify/pull/627
• https://hackerone.com/reports/303632
• https://github.com/fastify/fastify/pull/627
• https://hackerone.com/reports/303632

Get alerted when CVE-2018-3711 or the next vulnerability affects your stack