{"id":"CVE-2022-23623","aliases":["GHSA-8xxm-h73r-ghfj"],"url":"https://o3.security/vulnerability/CVE-2022-23623","summary":"Validation bypass in frourio","details":"## 日本語\n\n### 影響\nv0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。\n\n### パッチ\nfrourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。\n\n### ワークアラウンド\ncontroller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。\n\n### さらなる情報\n\nこのセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。\n* [frourio](https://github.com/frouriojs/frourio)にIssueを開く。\n\n## English\n\n### Impact\nFrourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)\n\n### Patches\nPlease update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.\n\n### Workarounds\nValidate objects from request with class-transformer in controllers by yourself, or prevent using validators.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [frourio](https://github.com/frouriojs/frourio)\n","published":"2022-02-07T22:15:16Z","modified":"2026-08-27T03:49:40.304612497Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.01244,"percentile":0.66496,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"frourio","fixedVersion":"0.26.0"}],"fix":{"url":"https://github.com/frouriojs/frourio/commit/7c19ac5363305b81b1c6b5232620228763d427af","label":"frouriojs/frourio@7c19ac5"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23623.json"},{"type":"ADVISORY","url":"https://github.com/frouriojs/frourio/security/advisories/GHSA-8xxm-h73r-ghfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23623"},{"type":"FIX","url":"https://github.com/frouriojs/frourio/commit/7c19ac5363305b81b1c6b5232620228763d427af"},{"type":"PACKAGE","url":"https://github.com/frouriojs/frourio"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T03:49:40.304612497Z"}}