CVE-2026-25223

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fastify.dev/docs/latest/Reference/Validation-and-Serialization	Product Technical Description
https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125	Product
https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272	Product
https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821	Patch
https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq	Vendor Advisory Mitigation
https://hackerone.com/reports/3464114	Permissions Required

Configurations

Configuration 1 (hide)

cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-02-03 22:16

Updated : 2026-02-10 20:05

NVD link : CVE-2026-25223

Mitre link : CVE-2026-25223

CVE.ORG link : CVE-2026-25223

JSON object : View

Products Affected

fastify

fastify

CWE

CWE-436

Interpretation Conflict

{"id": "CVE-2026-25223", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-02-03T22:16:31.130", "references": [{"url": "https://fastify.dev/docs/latest/Reference/Validation-and-Serialization", "tags": ["Product", "Technical Description"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq", "tags": ["Vendor Advisory", "Mitigation"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3464114", "tags": ["Permissions Required"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-436"}]}], "descriptions": [{"lang": "en", "value": "Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2."}, {"lang": "es", "value": "Fastify es un framework web r\u00e1pido y de baja sobrecarga, para Node.js. Antes de la versi\u00f3n 5.7.2, existe una vulnerabilidad de omisi\u00f3n de validaci\u00f3n en Fastify donde los esquemas de validaci\u00f3n del cuerpo de la solicitud especificados por Content-Type pueden ser completamente eludidos. Al a\u00f1adir un car\u00e1cter de tabulaci\u00f3n (\\t) seguido de contenido arbitrario al encabezado Content-Type, los atacantes pueden omitir la validaci\u00f3n del cuerpo mientras el servidor sigue procesando el cuerpo como el tipo de contenido original. Este problema ha sido parcheado en la versi\u00f3n 5.7.2."}], "lastModified": "2026-02-10T20:05:15.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "51FAFCEB-4FBC-4777-BC6D-91713CA5828A", "versionEndExcluding": "5.7.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}