# CVE-2026-25223: Fastify validation bypass via Content-Type header manipulation

Source: https://junglewise.ai/threats/cve-2026-25223-fastify-validation-bypass-via-content-type-header-manipulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-25223 · Severity: high · CVSS 7.5 · Published 2026-02-03

Fastify is a popular web framework used to build high-performance Node.js applications. A security flaw allows attackers to bypass data validation checks by slightly modifying the 'Content-Type' header in their requests. This could allow malicious or malformed data to reach the application's core logic, potentially leading to data corruption or unauthorized actions that the validation was intended to prevent.

Technologies: [fastify (npm)](https://junglewise.ai/threats/technologies/fastify). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25223 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25223 being exploited in the wild.

**How severe is CVE-2026-25223?** High severity, with a CVSS score of 7.5, published 3 February 2026.

**Which products and versions are affected?** fastify (npm) SEMVER:introduced=0,fixed=5.7.2.

**Is there a fix for CVE-2026-25223?** Yes. fastify (npm): upgrade to 5.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25223 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25223?** Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fastify (npm): upgrade to 5.7.2 or later

  ```sh
  npm install fastify@5.7.2
  ```


## Technical details

A validation bypass vulnerability exists in Fastify's request handling logic due to an interpretation conflict in how the 'Content-Type' header is parsed. When a body validation schema is defined for specific content types, an attacker can append a tab character (\t) followed by arbitrary text to the Content-Type header. This causes the validation layer to fail to match the header against the defined schema (resulting in no validation being applied), while the underlying content-type parser still recognizes and processes the body as the original intended type (e.g., application/json). This allows unvalidated payloads to be processed by the application. The issue is fixed in version 5.7.2 by improving the robustness of the content-type parsing algorithm.

## Affected products

- fastify fastify < 5.7.2
- Red Hat Red Hat OpenShift AI 2.16, 2.25
- Red Hat Red Hat OpenShift Dev Spaces 3.27
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 3

## Identifiers

- CVE-2026-25223
- GHSA-jx2c-rxcm-jvmq

## Timeline

- 2026-01-26: patched: Fix committed to repository
- 2026-02-03: disclosed: Initial advisory published

## References

- [https://fastify.dev/docs/latest/Reference/Validation-and-Serialization](https://fastify.dev/docs/latest/Reference/Validation-and-Serialization)
- [https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js](https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js)
- [https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js](https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js)
- [https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821](https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821)
- [https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq](https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq)
- [https://hackerone.com/reports/3464114](https://hackerone.com/reports/3464114)
- [https://access.redhat.com/errata/RHSA-2026:10184](https://access.redhat.com/errata/RHSA-2026:10184)

## Related threats

- [fastify is vulnerable to header validation bypass via case-sensitive propertyNames](https://junglewise.ai/threats/cve-2026-107832-fastify-is-a-fast-and-low-overhead-web-framework-for-node-js-in)
- [Fastify denial of service via unhandled exception on HTTP/2 trailer responses](https://junglewise.ai/threats/cve-2026-92081-fastify-denial-of-service-via-unhandled-exception-on-http-2)
- [Fastify header validation bypass via incomplete schema case normalization](https://junglewise.ai/threats/cve-2026-84428-fastify-header-validation-bypass-via-incomplete-schema-case)
- [Fastify request body replacement via async validation result collision](https://junglewise.ai/threats/cve-2026-84504-fastify-request-body-replacement-via-async-validation-result)
- [Fastify request validation bypass via skipped boolean false schemas](https://junglewise.ai/threats/cve-2026-84469-fastify-request-validation-bypass-via-skipped-boolean-false)