CVE-2026-25223

What it actually does

A validation bypass vulnerability in the Fastify web framework allows an unauthenticated remote attacker to circumvent request body validation. By appending a tab character (`\t`) to the `Content-Type` header of an HTTP request, an attacker can cause the framework to fail to locate the appropriate validation schema. While the validation is skipped, the underlying server still processes the request body, allowing malformed or malicious data to be passed to the application logic. This can lead to data integrity violations or create preconditions for further attacks like SQL Injection if the unvalidated data is used in downstream operations.

Why it matters to the business

This vulnerability allows attackers to bypass critical data validation checks, which can lead to the processing of malicious or malformed data. This could result in data corruption, unauthorized modification of records, and circumvention of business logic. For example, an attacker could submit an order with a negative price or inject harmful data that disrupts application services. The high integrity impact (CVSS I:H) signifies a serious risk to the trustworthiness of the application's data and functionality, potentially leading to financial loss, operational disruption, and reputational damage.

How an attack unfolds

An unauthenticated attacker targets a public-facing API endpoint built with a vulnerable version of Fastify. The attacker identifies an endpoint that expects a structured request body (e.g., JSON) and has a validation schema defined. The attacker then crafts an HTTP request containing a malicious payload that would normally be rejected by this schema. To bypass the check, the attacker modifies the `Content-Type` header, appending a tab character and arbitrary text (e.g., changing `application/json` to `application/json\t-bypass`). The vulnerable Fastify server receives the request, fails to match the manipulated `Content-Type` to any known schema, and therefore skips the validation step entirely. The request, along with its malicious body, is then passed to the application's handler logic for processing, leading to a successful integrity compromise.

How to fix it

To remediate this vulnerability, upgrade the `fastify` package to version 5.7.2 or later. Update the dependency in your project's `package.json` file and run your package manager's install command (e.g., `npm install` or `yarn install`) to apply the fix. If an immediate upgrade is not possible, consider implementing a temporary mitigation at a reverse proxy or WAF to inspect and normalize incoming `Content-Type` headers by stripping any content following a tab character.

How to confirm the fix worked

To validate the patch, first confirm that the installed version of the `fastify` package is 5.7.2 or higher by checking your project's lock file (`package-lock.json` or `yarn.lock`) or by running `npm list fastify`. To test the behavior, create a test endpoint with a known validation schema. Send a request with an invalid body and a manipulated `Content-Type` header (e.g., `Content-Type: application/json\t-test`). A patched system will correctly apply validation and reject the request with a 400-level error. A vulnerable system would incorrectly process the request, likely returning a 200-level status code.

Typical attack path

1. An attacker identifies a web application using a vulnerable version of the Fastify framework (prior to 5.7.2).
2. The attacker discovers an API endpoint that performs validation on the request body based on its Content-Type.
3. A malicious request body is crafted that violates the endpoint's validation rules.
4. The attacker modifies the request's `Content-Type` header by appending a tab character (`\t`) followed by arbitrary data.
5. The crafted HTTP request is sent to the target endpoint.
6. The Fastify server fails to find a matching validation schema and skips validation, passing the malicious body to the application logic for processing.

How to detect it

To detect potential exploitation attempts, security teams should search web server access logs, load balancer logs, or WAF logs for HTTP requests containing a tab character (`\t`) or its URL-encoded equivalent (`%09`) within the `Content-Type` header. The presence of such a header is a strong indicator of an attempt to exploit this vulnerability. If found, correlate the request with application-level logs to determine if a malicious body was processed and what impact it may have had on backend systems or data.

• Content-Type: application/json\t
• Content-Type: application/x-www-form-urlencoded\t
• Content-Type: multipart/form-data\t
• Content-Type: application/json%09
• Content-Type: application/x-www-form-urlencoded%09
• Content-Type: multipart/form-data%09

What your security team should do

• Identify all applications using the Fastify framework and upgrade any instances running versions prior to 5.7.2.
• Prioritize patching for public-facing applications that accept and validate complex user-supplied data.
• If patching cannot be immediately deployed, implement a WAF rule to block or sanitize requests containing a tab character (`\t` or `%09`) in the `Content-Type` header.
• Review web server and application logs for historical evidence of exploitation attempts by searching for malformed `Content-Type` headers.