Fastify's Content-Type header tab character allows body validation bypass
Priority LOW 34CWE-436Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 3 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00862 58th percentileScored 2026-11-07
Fix Partial fastify (fastify): 5.7.2fastify (npm): 5.7.2Red Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fastify | fastify | before 5.7.2 | 5.7.2 | Patch available | CNA |
| — | fastify (npm) | before 5.7.2 | 5.7.2 | Patch available | GHSA-jx2c-rxcm-jvmq |
- fastify Vendorfastify Affected before 5.7.2 Fixed in 5.7.2 Patch available CNA
- fastify (npm) Vendor— Affected before 5.7.2 Fixed in 5.7.2 Patch available GHSA-jx2c-rxcm-jvmq
Remediation
- Fix · CNA fastify (fastify) Fixed in 5.7.2
- Fix · GHSA-jx2c-rxcm-jvmq fastify (npm) Fixed in 5.7.2 Advisory →
Red Hat 3 advisories
- RHSA-2026:10184 Released 2026-04-23 · Red Hat rating ImportantRHOAI 2.25.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:6192 Released 2026-03-30 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.27.0 Release.
- Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
- RHSA-2026:5807 Released 2026-03-25 · Red Hat rating ImportantRHOAI 2.16.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +12
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI 2.16 | Fixed | RHSA-2026:5807 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:10184 |
| Red Hat OpenShift Dev Spaces 3.27 | Fixed | RHSA-2026:6192 |
Not affected: 3 products
- Red Hat OpenShift AI 2.16
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift Dev Spaces 3.27
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25223
- 2026-10-03 Alias added: GHSA-jx2c-rxcm-jvmq
References
Advisory 2
Other 5
- https://hackerone.com/reports/3464114
- https://fastify.dev/docs/latest/Reference/Validation-and-Serialization
- https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
- https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
- https://github.com/fastify/fastify
More Fastify vulnerabilities
- TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
- TI-2025-23513 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass CVSS 3.1HIGH 7.5
- TI-2026-58050 fastify vulnerable to request validation bypass via skipped boolean false schemas CVSS 3.1HIGH 7.5
- TI-2026-58022 fastify vulnerable to header validation bypass via incomplete schema case normalization CVSS 3.1HIGH 7.5
- TI-2026-53284 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVSS 3.1HIGH 7.5
- TI-2026-26178 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header CVSS 3.1HIGH 7.5
Sources
- CVE-2026-25223 · CVE Program
- CVE-2026-25223 · NVD
- FIRST EPSS
- GHSA-jx2c-rxcm-jvmq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-25223 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences