CVE-2026-25223: fastify Interpretation Conflict
Vulnerability summary
CVE-2026-25223 is a high (CVSS 7.5) Interpretation Conflict vulnerability in fastify. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.2% of scored vulnerabilities.
Timeline
- 03-02-2026PublishedVulnerability first disclosed.
- 16-09-2026Last modifiedVulnerability information updated.
Description
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.88%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
+0.08 pp
From 0.80% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-436Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
- CWE-179Incorrect Behavior Order: Early ValidationThe product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.
Affected systems
Fastify1 product
- fastify< 5.7.2
Npm1 product
- fastify< 5.7.2
2 vendors · 2 products
References
14 links- github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmqX Refsource CONFIRMWEBMitigationVendor Advisory
- fastify.dev/docs/latest/Reference/Validation-and-SerializationX Refsource MISCWEBProductTechnical Description
- github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.jsX Refsource MISCWEBProduct
- github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.jsX Refsource MISCWEBProduct
Show all 14 references
- github.com/fastify/fastifyPACKAGE