valexandersaulys/tiny-csrf

Releases0

Stars27

Tiny CSRF for express js applications

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2022-39287 ↗	Oct 7, 2022Friday, 7 October 2022, 20:15	8.1 HIGH	—
tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.