CVE-2026-25223 Fastify's Content-Type header tab character allows body validation bypass

What is CVE-2026-25223?

CVE-2026-25223 is a high-severity vulnerability in fastify, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

Weakness: CWE-179, CWE-436

Which versions are affected by CVE-2026-25223?

2 open source packages ship an affected version, including fastify. It affects 1 product.

Products include Fastify Fastify.

How do I fix CVE-2026-25223?

Upgrade fastify to 5.7.2 or later.

Is CVE-2026-25223 being exploited?

There is no known exploitation of CVE-2026-25223 in the wild and no public exploit code.

Other vulnerabilities in fastify

• CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision High 8.1
• CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers High 7.5
• CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization High 7.5
• CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas High 7.5
• CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jx2c-rxcm-jvmq, MINI-76p2-695q-hg3p.