CVE-2026-25223

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-436 CWE-179

Affected software

Vendor	Product	Versions
fastify	fastify	< 5.7.2
Red Hat	Red Hat OpenShift AI 2.16	—
Red Hat	Red Hat OpenShift AI 2.25	—
Red Hat	Red Hat OpenShift AI 2.25	—
Red Hat	Red Hat OpenShift Dev Spaces 3.27	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—

References

Timeline

Published: Feb 3, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-252243.7Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web St CVE-2026-252277.2authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions,CVE-2026-252284.3Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Ser CVE-2026-252296.5Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authentica CVE-2026-25237.5A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function smf_gn_handle_create_pdp_context_request of the fi CVE-2026-252305.4FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to CVE-2026-252317.5FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read v CVE-2026-252328.8Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repos CVE-2026-252339.1PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows CVE-2026-252349.8PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category CVE-2026-252357.5PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow CVE-2026-252369.8PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queri