CVE-2026-25223— Fastify's Content-Type header tab character allows body validation bypass
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-25223
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fastify's Content-Type header tab character allows body validation bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
解释冲突
Source: NVD (National Vulnerability Database)
Vulnerability Title
Fastify 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Fastify是Fastify开源的一个 Web 框架。 Fastify 5.7.2之前版本存在安全漏洞，该漏洞源于请求正文验证模式可被完全绕过，可能导致攻击者绕过正文验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-25223
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25223
请登录查看更多情报信息。
- Validation-and-Serialization | Fastifyx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-25223
IV. Related Vulnerabilities
Same product: fastify
- CVE-2026-33806
fastify vulnerable to Body Schema Validation Bypass via Lead - CVE-2026-3635
Fastify request.protocol and request.host spoofable via X-Fo - CVE-2026-3419
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malf - CVE-2026-25224
Fastify Vulnerable to DoS via Unbounded Memory Allocation in - CVE-2025-32442
Fastify vulnerable to invalid content-type parsing, which co
Same vendor: fastify
- CVE-2026-33807
@fastify/express vulnerable to middleware path doubling caus - CVE-2026-33808
@fastify/express vulnerable to middleware authentication byp - CVE-2026-33806
fastify vulnerable to Body Schema Validation Bypass via Lead - CVE-2026-3635
Fastify request.protocol and request.host spoofable via X-Fo - CVE-2026-3419
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malf
Same weakness: CWE-436
- CVE-2026-42273
Heimdall: Case-sensitive host matching may lead to policy by - CVE-2026-42272
Heimdall: Case-sensitive handling of URL-encoded slashes may - CVE-2026-30246
github.com/gofiber/fiber/v3 cache middleware can mix respons - CVE-2026-6322
fast-uri vulnerable to host confusion via percent-encoded au - CVE-2026-41248
Official Clerk JavaScript SDKs: Middleware-based route prot
V. Comments for CVE-2026-25223
No comments yet