CVE-2026-25223 HIGH

CVE-2026-25223: Fastify's Content-Type header tab character allows body validation bypass

Vendor Fastify
Product fastify
Weakness CWE-436
Published February 3, 2026
Last update June 30, 2026

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

Key dates

02Disclosure timeline

February 3, 2026 CVE published
June 30, 2026 Record updated