Validation Bypass Vulnerability in Fastify Web Framework for Node.js

CVE-2026-25223

What is CVE-2026-25223?

Fastify, a fast web framework for Node.js, was found to have a validation bypass vulnerability that allows attackers to circumvent request body validation schemas tied to the Content-Type header. By introducing a tab character followed by additional content in the Content-Type header, attackers could potentially manipulate how the server processes the request body, leading to unexpected behavior and possible security risks. This vulnerability was addressed in version 5.7.2, emphasizing the importance of keeping software updated to mitigate such risks.

References