Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-25223

27
FAUCET Score

CVE-2026-25223 is a validation bypass vulnerability in Fastify, a Node.js web framework, affecting versions prior to 5.7.2. Attackers can circumvent request body validation schemas by appending a tab character and arbitrary content to the Content-Type header, allowing the server to process an unvalidated body as the original content type. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-exploitable flaw with low attack complexity and high impact on integrity, but no impact on confidentiality or availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 5.7.2CPE matchmatch criteria
cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.77%
Probability of exploitation in next 30 days
EPSS Percentile
51.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0077 is in the 27th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (9)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: fastifyFixed in: 5.7.2
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/disk-image-cuda-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-dashboard-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-dashboard-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-mod-arch-gen-ai-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-mod-arch-model-registry-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/dashboard-rhel9
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-cuda-rhel9

Vendor Advisories (2)

redhatCVE-2026-25223Important

Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact

Feb 3, 2026
npmGHSA-jx2c-rxcm-jvmqhigh

Fastify's Content-Type header tab character allows body validation bypass

Feb 2, 2026

References

access.redhat.com / errata/RHSA-2026:10184
access.redhat.com / errata/RHSA-2026:5807
access.redhat.com / errata/RHSA-2026:6192
access.redhat.com / security/cve/CVE-2026-25223
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-25223.json
fastify.dev / docs/latest/Reference/Validation-and-Serialization
ProductTechnical Description
github.com / fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js
Product
github.com / fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js
Product
github.com / fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821
Patch
github.com / fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq
MitigationVendor Advisory
hackerone.com / reports/3464114
Permissions Required