CVE-2022-39287: Plaintext transmission of CSRF tokens in tiny-csrf

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-07 · updated 2026-06-17
Weakness: CWE-319

Description

tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

valexandersaulys tiny-csrf: before 1.1.0 — fixed in 1.1.0

How to fix

Upgrade to a fixed version: valexandersaulys tiny-csrf 1.1.0. Check the vendor advisory for mitigations.

References

https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba
https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f
https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba
https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f

Get alerted when CVE-2022-39287 or the next vulnerability affects your stack