CVE-2026-25223

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

• CWE-436
• CWE-179

• https://fastify.dev/docs/latest/Reference/Validation-and-SerializationProduct, Technical Description
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125Product
• https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272Product
• https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821Patch
• https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmqMitigation, Vendor Advisory
• https://hackerone.com/reports/3464114Permissions Required
• https://access.redhat.com/errata/RHSA-2026:10184
• https://access.redhat.com/errata/RHSA-2026:5807
• https://access.redhat.com/errata/RHSA-2026:6192
• https://access.redhat.com/security/cve/CVE-2026-25223
• https://bugzilla.redhat.com/show_bug.cgi?id=2436560
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25223.json

Published

Feb 3, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25212An issue was discovered in Percona PMM before 3.7. Because a…9.9
• CVE-2026-25219The `access_key` and `connection_string` connection properti…6.5
• CVE-2026-2522A security vulnerability has been detected in Open5GS up to …9.8
• CVE-2026-25220OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25221PolarLearn is a free and open-source learning program. In 0-…8.1
• CVE-2026-25222PolarLearn is a free and open-source learning program. In 0-…7.5
• CVE-2026-25224Fastify is a fast and low overhead web framework, for Node.j…3.7
• CVE-2026-25227authentik is an open-source identity provider. From 2021.3.1…7.2
• CVE-2026-25228Signal K Server is a server application that runs on a centr…4.3
• CVE-2026-25229Gogs is an open source self-hosted Git service. Versions 0.1…6.5
• CVE-2026-2523A vulnerability was detected in Open5GS up to 2.7.6. The aff…7.5
• CVE-2026-25230FileRise is a self-hosted web file manager / WebDAV server. …5.4