CVE-2026-25223

HIGH

fastify < 5.7.2 - Request Body Validation Bypass via Content-Type Header Tab Injection

Title source: llm
STIX 2.1

Description

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

References (12)

Core 12
Core References
Vendor Advisory, Mitigation x_refsource_confirm
https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq
Permissions Required x_refsource_misc
https://hackerone.com/reports/3464114
Product, Technical Description x_refsource_misc
https://fastify.dev/docs/latest/Reference/Validation-and-Serialization

Scores

CVSS v3 7.5
EPSS 0.0077
EPSS Percentile 52.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-179 CWE-436
Status published
Products (2)
fastify/fastify < 5.7.2 (2 CPE variants)
npm/fastify 0 - 5.7.2npm
Published Feb 03, 2026
Tracked Since Feb 18, 2026