You appear to be offline. Some site functionality may not work.
Sign Up

Security advisories

Vulnerability in modern processors

January 9, 2018

On Wednesday, January 3rd, research was published on a class of security vulnerabilities affecting specific processors. These vulnerabilities could allow a user who can execute code on a system to gain unauthorized access to information across security boundaries.

Fastly has completed initial analysis of these vulnerabilities and does not believe they pose an immediate threat to Fastly customers.

Read More

Request body disclosure to other Fastly services

January 8, 2018

From August 31st through November 4th, Fastly deployed a version of Varnish which contained a security bug that, in a limited and non-standard set of configurations, disclosed request bodies to other customer origins. In these cases, a request body sent to an affected Fastly customer’s service would have been included in a malformed request to a different customer’s origin, which may have been logged in that origin web server’s access logs.

Fastly performed a comprehensive assessment to identify customers most likely to be affected by this issue. These customers have been contacted directly by Fastly Customer Engineering.

Read More

Vulnerability in Fastly open source CDN module intended to be integrated into Magento2

September 12, 2017

During the investigation of a customer report, Fastly became aware of and addressed a security vulnerability (CVE-2017-13761) in the Fastly CDN module intended to be integrated into Magento2. This is open source code which Fastly releases to enable easy integration with our partner’s products. All versions prior to 1.2.26 are affected and customers are encouraged to upgrade.

Fastly has reached out directly to customers currently using affected versions of the module.

Read More

Resolved: Fastly “forward secrecy” vulnerability

November 16, 2016

On Monday, November 14, 2016, security researchers published a paper “Measuring the Security Harm of TLS Crypto Shortcuts.” Among other findings across the TLS implementation of several sites, the paper identified Fastly as not frequently rotating TLS session tickets, limiting the effectiveness of forward secrecy.

While Fastly was not directly contacted by the researchers, Fastly had previously been made aware of the issue, and this vulnerability was addressed on Friday, November 11. No customer action is required to benefit from the fix.

Read More

Widespread Dyn DNS outage affecting Fastly customers

October 21, 2016

On October 21st, 2016, Dyn, a major managed DNS provider, experienced a Distributed Denial of Service attack, which led to outages affecting several major websites, including Fastly infrastructure (such as the Fastly Control Panel and API) and Fastly customers.

Fastly worked with our additional managed DNS providers to ensure availability during the incident. This mitigated impact on Fastly customers.

Read More

GlobalSign TLS certificate revocation errors

October 18, 2016

On October 13, 2016 around 11:10am GMT, users visiting websites using GlobalSign TLS certificates, including some hosted by Fastly, started experiencing TLS certificate validation errors. This issue was caused by incorrect certificate revocation information published by our certificate vendor, GlobalSign.

This security advisory describes the root cause of this issue, and describes the actions Fastly has taken to limit customer impact.

Read More

Vulnerability in use of HTTP_PROXY by CGI

July 18, 2016

On Monday, July 18, 2016, security researchers published information on a vulnerability in the handling of the HTTP_PROXY environment variable by specific Common Gateway Interface (CGI) scripts. While this vulnerability does not affect Fastly, web servers used as origins may run a variety of scripts, some of which may be vulnerable. This Security Advisory provides guidance to customers on how they can protect origin servers from attacks.

Read More

DROWN Attack & Fastly

March 1, 2016

Today in conjunction with an OpenSSL Security Advisory several researchers announced a new attack on HTTPS they are calling “Decrypting RSA with Obsolete and Weakened Encryption,” or DROWN. Due to Fastly’s existing TLS configuration, our services, and customers using Fastly as their CDN, are not vulnerable to this attack.

Read More

Securing Edge-To-Origin TLS

February 18, 2016

Fastly has fixed a problem in our default Transport Layer Security (TLS) configuration that prevented proper certificate validation when connecting to customer origin servers. Services created after September 6th, 2015 were not affected. This advisory describes the issue to inform our customers of the potential exposure, the fix we’ve made, and additional improvements we’re making.

This vulnerability has been assigned Fastly Security severity rating of HIGH.

Read More

CVE-2015-7547 Buffer Overflow in glibc

February 16, 2016

On Tuesday, February 16th, researchers published details about a new vulnerability in the glibc library, a standard C library. The vulnerability existed in the code used to translate hostnames into IP addresses. Processes that use it are very common across network service providers, such as CDNs.

Fastly immediately implemented a security update on affected systems. No customer action is required. Fastly’s service was not impacted.

Read More

Thanks for subscribing.