"value":"Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type\u2019s essence as \"application/x-www-form-urlencoded\", \"multipart/form-data\", or \"text/plain\", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'."
"value":"Fastify es un framework web con una arquitectura de complementos y gastos generales m\u00ednimos. El atacante puede utilizar el \"Content-Type\" incorrecto para omitir la comprobaci\u00f3n \"Pre-Flight\" de \"fetch\". Las solicitudes `fetch()` con la esencia de Content-Type como \"application/x-www-form-urlencoded\", \"multipart/form-data\" o \"text/plain\", podr\u00edan usarse potencialmente para invocar rutas que solo acepta el tipo de contenido `application/json`, evitando as\u00ed cualquier protecci\u00f3n CORS y, por lo tanto, podr\u00eda provocar un ataque de Cross-Site Request Forgery (CSRF). Este problema se solucion\u00f3 en las versiones 4.10.2 y 3.29.4. Como workaround, implemente la protecci\u00f3n contra Cross-Site Request Forgery (CSRF) utilizando `@fastify/csrf'."
