{"id":"GHSA-8h2j-cgx8-6xv7","summary":"Cross-Site Request Forgery (CSRF) in FastAPI","details":"### Impact\n\nFastAPI versions lower than `0.65.2` that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack.\n\nIn versions lower than `0.65.2`, FastAPI would try to read the request payload as JSON even if the `content-type` header sent was not set to `application/json` or a compatible JSON media type (e.g. `application/geo+json`).\n\nSo, a request with a content type of `text/plain` containing JSON data would be accepted and the JSON data would be extracted.\n\nBut requests with content type `text/plain` are exempt from [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) preflights, for being considered [Simple requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests). So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.\n\n### Patches\n\nThis is fixed in FastAPI `0.65.2`.\n\nThe request data is now parsed as JSON only if the `content-type` header is `application/json` or another JSON compatible media type like `application/geo+json`.\n\n### Workarounds\n\nIt's best to upgrade to the latest FastAPI.\n\nBut still, it would be possible to add a middleware or a dependency that checks the `content-type` header and aborts the request if it is not `application/json` or another JSON compatible content type.\n\n### References\n\n* [CORS on Mozilla web docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n* [This answer on StackExchange](https://security.stackexchange.com/questions/157528/ways-to-bypass-browsers-cors-policy/157531#157531)\n* [OWASP CSRF](https://owasp.org/www-community/attacks/csrf)\n* Fixed in PR [#2118](https://github.com/tiangolo/fastapi/pull/2118)\n\n### For more information\n\nIf you have any questions or comments, write to [security@tiangolo.com](mailto:security@tiangolo.com)","aliases":["CVE-2021-32677","PYSEC-2021-100"],"modified":"2026-07-08T06:28:18.554408310Z","published":"2021-06-10T15:43:54Z","database_specific":{"cwe_ids":["CWE-352"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-06-09T13:34:54Z","nvd_published_at":"2021-06-09T18:15:00Z"},"references":[{"type":"WEB","url":"https://github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32677"},{"type":"WEB","url":"https://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/fastapi/PYSEC-2021-100.yaml"},{"type":"PACKAGE","url":"https://github.com/tiangolo/fastapi"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MATAWX25TYKNEKLDMKWNLYDB34UWTROA"}],"affected":[{"package":{"name":"fastapi","ecosystem":"PyPI","purl":"pkg:pypi/fastapi"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65.2"}]}],"versions":["0.1.0","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.18","0.1.19","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.11.0","0.12.0","0.12.1","0.13.0","0.14.0","0.15.0","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.2.1","0.20.0","0.20.1","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.27.1","0.27.2","0.28.0","0.29.0","0.29.1","0.3.0","0.30.0","0.30.1","0.31.0","0.32.0","0.33.0","0.34.0","0.35.0","0.36.0","0.37.0","0.38.0","0.38.1","0.39.0","0.4.0","0.40.0","0.41.0","0.42.0","0.43.0","0.44.0","0.44.1","0.45.0","0.46.0","0.47.0","0.47.1","0.48.0","0.49.0","0.49.1","0.49.2","0.5.0","0.5.1","0.50.0","0.51.0","0.52.0","0.53.0","0.53.1","0.53.2","0.54.0","0.54.1","0.54.2","0.55.0","0.55.1","0.56.0","0.56.1","0.57.0","0.58.0","0.58.1","0.59.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.60.0","0.60.1","0.60.2","0.61.0","0.61.1","0.61.2","0.62.0","0.63.0","0.64.0","0.65.0","0.65.1","0.7.0","0.7.1","0.8.0","0.9.0","0.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-8h2j-cgx8-6xv7/GHSA-8h2j-cgx8-6xv7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"}]}