CVE-2026-25223
Fastify's Content-Type header tab character allows body validation bypass
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.
| CWE | CWE-436 |
| Vendor | fastify |
| Product | fastify |
| Published | Feb 3, 2026 |
| Last Updated | Jun 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for fastify fastify
Be the first to know when new high vulnerabilities affecting fastify fastify are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
fastify / fastify
< 5.7.2
References
github.com: https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq github.com: https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821 hackerone.com: https://hackerone.com/reports/3464114 fastify.dev: https://fastify.dev/docs/latest/Reference/Validation-and-Serialization github.com: https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125 github.com: https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-25223 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2436560 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25223.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5807 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10184 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6192