{"cve":"CVE-2022-39287","nvd":{"published":"2022-10-07T20:15:15.060","modified":"2026-06-17T04:58:04.520","status":"Modified","description":"tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-319"],"references":["https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba","https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f","https://github.com/valexandersaulys/tiny-csrf/commit/8eead6da3b56e290512bbe8d20c2c5df3be317ba","https://github.com/valexandersaulys/tiny-csrf/security/advisories/GHSA-pj2c-h76w-vv6f"],"products":["tiny-csrf_project:tiny-csrf"],"source":"nvd","synced_at":"2026-10-19T21:36:05.460296998+00:00"},"epss":{"cve":"CVE-2022-39287","score":0.0052,"percentile":0.44197,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-pj2c-h76w-vv6f","url":"https://osv.dev/vulnerability/GHSA-pj2c-h76w-vv6f","summary":"tiny-csrf has openly visible CSRF tokens","modified":"2023-11-08T04:10:17.775107Z","packages":[{"ecosystem":"npm","name":"tiny-csrf","purl":"pkg:npm/tiny-csrf","ranges":["<1.1.0"],"fixed":["1.1.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}