CVE-2026-25223: Fastify validation bypass via Content-Type header manipulation

CVE-2026-25223 · Severity: high · CVSS 7.5 · Published 2026-02-03

Fastify is a popular web framework used to build high-performance Node.js applications. A security flaw allows attackers to bypass data validation checks by slightly modifying the 'Content-Type' header in their requests. This could allow malicious or malformed data to reach the application's core logic, potentially leading to data corruption or unauthorized actions that the validation was intended to prevent.

Technologies: fastify (npm). Vendors: npm.

Quick answers

Is CVE-2026-25223 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25223 being exploited in the wild.
How severe is CVE-2026-25223?
High severity, with a CVSS score of 7.5, published 3 February 2026.
Which products and versions are affected?
fastify (npm) SEMVER:introduced=0,fixed=5.7.2.
Is there a fix for CVE-2026-25223?
Yes. fastify (npm): upgrade to 5.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25223 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-25223?
Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fastify (npm): upgrade to 5.7.2 or later
    npm install fastify@5.7.2

Technical details

A validation bypass vulnerability exists in Fastify's request handling logic due to an interpretation conflict in how the 'Content-Type' header is parsed. When a body validation schema is defined for specific content types, an attacker can append a tab character (\t) followed by arbitrary text to the Content-Type header. This causes the validation layer to fail to match the header against the defined schema (resulting in no validation being applied), while the underlying content-type parser still recognizes and processes the body as the original intended type (e.g., application/json). This allows unvalidated payloads to be processed by the application. The issue is fixed in version 5.7.2 by improving the robustness of the content-type parsing algorithm.

Affected products

  • fastify fastify < 5.7.2
  • Red Hat Red Hat OpenShift AI 2.16, 2.25
  • Red Hat Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 3

Identifiers

  • CVE-2026-25223
  • GHSA-jx2c-rxcm-jvmq

Timeline

  • 2026-01-26: patched: Fix committed to repository
  • 2026-02-03: disclosed: Initial advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.