CVE-2026-25223highCWE-179CWE-436

CVE-2026-25223: falha de alta gravidade em fastify

Fastify's Content-Type header tab character allows body validation bypass

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar fastify+ Monitorar fastify

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.9%
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
fastify · fastify
CVEs relacionadas — fastify

No mesmo produto, das mais perigosas para as menos.

CVE-2022-39288HIGHDenial of service in Fastify via Content-Type headerEPSS 59.2%CVE-2025-32442HIGHFastify vulnerable to invalid content-type parsing, which could lead to validation bypassEPSS 0.7%CVE-2026-25224LOWFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStreamEPSS 0.5%CVE-2026-76169HIGHfastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlersEPSS 0.5%CVE-2026-84428HIGHfastify vulnerable to header validation bypass via incomplete schema case normalizationEPSS 0.5%CVE-2026-84469HIGHfastify vulnerable to request validation bypass via skipped boolean false schemasEPSS 0.5%