CVE-2026-25223
High
Description
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Fastify
PublishedFeb 3, 2026
First seenFeb 3, 2026
Weakness typeCWE-436CWE-436
How to fix
Update
- fastify fastify5.7.2 or later
- fastify5.7.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fastify fastify | v < 5.7.2 | 5.7.2 |
| fastifynpm | v < 5.7.2 | 5.7.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.