CVE-2026-25223

HIGH EPSS 40.0%
Published Feb 3, 20264mo ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Feb 3, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
40.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-436

Affected Products 1

VendorProductVersionRange
fastifyfastify* <5.7.2

References 6

  • fastify.dev https://fastify.dev/docs/latest/Reference/Validation-and-Serialization
    ProductTechnical Description
  • github.com https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
    Product
  • github.com https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
    Product
  • github.com https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821
    Patch
  • github.com https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq
    MitigationVendor Advisory
  • hackerone.com https://hackerone.com/reports/3464114
    Permissions Required

Remediation

  • github.com https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821
    Patch