Validation Bypass in Fastify Web Framework Affecting Node.js Applications
CVE-2025-32442
What is CVE-2025-32442?
The Fastify web framework for Node.js, in versions 5.0.0 through 5.3.0, contains a vulnerability that allows attackers to bypass content type validation by specifying slightly altered content types. This vulnerability arises from a lack of strict validation when different content types are defined, which can include variations in casing or altered whitespacing before a separator. While the issue was addressed in version 5.3.1, subsequent patches in version 5.3.2 were necessary to fully mitigate all associated problems. Users are advised to upgrade to at least version 5.3.2 and consider avoiding the specification of individual content types in the schema as a temporary workaround.
Affected Version(s)
fastify >= 5.0.0, < 5.3.2 < 5.0.0, 5.3.2
fastify = 4.29.0 = 4.29.0