Read the docs
TI-2022-18760 Aliases CVE-2022-39386GHSA-4pcg-wr6c-h9cq

fastify-websocket vulnerable to uncaught exception via crash on malformed packet

Priority MEDIUM 40CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.

Summary

@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00864 58th percentileScored 2026-11-07
Fix Fixed fastify-websocket (fastify): 5.0.1, 7.1.1@fastify/websocket (npm): 5.0.1, 7.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastifyfastify-websocket5.0.0 to before 5.0.1; 6.0.0 to before 7.1.1; up to 4.3.05.0.1, 7.1.1Patch availableCNA
—@fastify/websocket (npm)5.0.0 to before 5.0.15.0.1Patch availableGHSA-4pcg-wr6c-h9cq
—@fastify/websocket (npm)6.0.0 to before 7.1.17.1.1Patch availableGHSA-4pcg-wr6c-h9cq
—fastify-websocket (npm)up to 4.3.0—No fix listedGHSA-4pcg-wr6c-h9cq
  • fastify-websocket Vendorfastify Affected 5.0.0 to before 5.0.1; 6.0.0 to before 7.1.1; up to 4.3.0 Fixed in 5.0.1, 7.1.1 Patch available CNA
  • @fastify/websocket (npm) Vendor— Affected 5.0.0 to before 5.0.1 Fixed in 5.0.1 Patch available GHSA-4pcg-wr6c-h9cq
  • @fastify/websocket (npm) Vendor— Affected 6.0.0 to before 7.1.1 Fixed in 7.1.1 Patch available GHSA-4pcg-wr6c-h9cq
  • fastify-websocket (npm) Vendor— Affected up to 4.3.0 Fixed in — No fix listed GHSA-4pcg-wr6c-h9cq

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:fastify:websocket:*:*:*:*:*:node.js:*:*6.0.0 to before 7.1.1Vulnerablefastify
cpe:2.3:a:fastify:websocket:5.0.0:*:*:*:*:node.js:*:*5.0.0Vulnerablefastify
  • cpe:2.3:a:fastify:websocket:*:*:*:*:*:node.js:*:* Versions 6.0.0 to before 7.1.1 Vulnerable ·fastify
  • cpe:2.3:a:fastify:websocket:5.0.0:*:*:*:*:node.js:*:* Versions 5.0.0 Vulnerable ·fastify

Remediation

  • Fix · CNA fastify-websocket (fastify) Fixed in 5.0.1, 7.1.1
  • Fix · GHSA-4pcg-wr6c-h9cq @fastify/websocket (npm) Fixed in 5.0.1 Advisory →
  • Fix · GHSA-4pcg-wr6c-h9cq @fastify/websocket (npm) Fixed in 7.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39386
  2. 2026-10-03 Alias added: GHSA-4pcg-wr6c-h9cq

References

Advisory 2

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences