CVE-2025-32442: fastify
Vulnerability summary
CVE-2025-32442 is a high (CVSS 7.5) vulnerability in fastify. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 18-04-2025PublishedVulnerability first disclosed.
- 22-08-2025Last modifiedVulnerability information updated.
Description
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.73%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.01 pp
From 0.72% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFastify
Maturity: poc
Weaknesses
CWE · root cause- CWE-1287Improper Validation of Specified Type of InputThe product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
- CWE-1289Improper Validation of Unsafe Equivalence in InputThe product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Affected systems
Fastify1 product
- fastify= 4.29.0 | ≥ 5.0.0, < 5.3.2 | 4.29.0 | ≥ 5.3.2, < 5.8.5
Npm1 product
- fastify≥ 5.0.0, < 5.3.2 | ≥ 4.29.0, < 4.29.1 | ≥ 5.3.2, < 5.8.5
2 vendors · 2 products
References
13 links- github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwcX Refsource CONFIRMWEBExploitThird Party AdvisoryNot Applicable
- github.com/fastify/fastifyPACKAGE