Fastly vulnerabilities

8 vulnerabilities

Known vulnerabilities in Fastly products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.

Products

4
6.1CVE-2015-10094fastlyfastly+1
EPSS score
0.55%
A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this issue is the function post of the file lib/api.php. The manipulation of the argument url leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.98 is able to address this issue. The patch is identified as d7fe42538f4d4af500e3af9678b6b06fba731656. It is recommended to upgrade the affected component. VDB-222326 is the identifier assigned to this vulnerability.4.3CVE-2025-58199fastlyfastly+1
EPSS score
0.14%
Cross-Site Request Forgery (CSRF) vulnerability in Fastly Fastly fastly allows Cross Site Request Forgery.This issue affects Fastly: from n/a through <= 1.2.28.7.5CVE-2025-8671alpinelighttpd+29
EPSS score
3.62%
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.7.5CVE-2022-39218fastlyjs-compute+2
EPSS score
0.92%
The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.6.5CVE-2017-13761fastlyfastly
EPSS score
1.22%
The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses.5.3CVE-2024-38375fastlyjs-compute-runtime+1
EPSS score
0.27%
@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the `@fastly/js-compute` package.5.3CVE-2024-34768fastlyfastly+1
EPSS score
0.36%
Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.4.3CVE-2024-34803fastlyfastly+1
EPSS score
0.28%
Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.