CVE-2020-28482: Fastify Fastify-Csrf

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter

Affected products

• Fastify Fastify-Csrf: before 3.0.0 (fixed in 3.0.0)

Published 2021-01-19. Last modified 2026-06-17.