Junglewise Threat Intelligence

CVE-2026-25223: Fastify validation bypass via Content-Type header manipulation

CVE-2026-25223 · Severity: high · CVSS 7.5 · Published 2026-02-03

Technologies: Red Hat Enterprise Linux AI (RHEL AI) 3, fastify (npm). Vendors: Red Hat, npm, Fastify.

Executive brief

Fastify is a popular web framework used to build high-performance Node.js applications. A security flaw allows attackers to bypass data validation checks by slightly modifying the 'Content-Type' header in their requests. This could allow malicious or malformed data to reach the application's core logic, potentially leading to data corruption or unauthorized actions that the validation was intended to prevent.

Technical details

A validation bypass vulnerability exists in Fastify's request handling logic due to an interpretation conflict in how the 'Content-Type' header is parsed. When a body validation schema is defined for specific content types, an attacker can append a tab character (\t) followed by arbitrary text to the Content-Type header. This causes the validation layer to fail to match the header against the defined schema (resulting in no validation being applied), while the underlying content-type parser still recognizes and processes the body as the original intended type (e.g., application/json). This allows unvalidated payloads to be processed by the application. The issue is fixed in version 5.7.2 by improving the robustness of the content-type parsing algorithm.

Affected products

  • fastify fastify < 5.7.2
  • Red Hat Red Hat OpenShift AI 2.16, 2.25
  • Red Hat Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 3

Timeline

  • 2026-01-26: patched: Fix committed to repository
  • 2026-02-03: disclosed: Initial advisory published

References

Related threats