VYPR
← All advisories
High severity7.5NVD Advisory· Published Feb 3, 2026· Updated Jul 15, 2026

CVE-2026-25223

CVE-2026-25223

Description

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
fastifynpm
< 5.7.25.7.2

Affected products

3
  • Fastify/Fastify2 versions
    cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*range: <5.7.2
    • (no CPE)range: < 5.7.2
  • ghsa-coords
    pkg:npm/fastify
    Range: < 5.7.2

Patches

Vulnerability mechanics

References

14

News mentions

0

No linked articles in our index yet.