7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25223

CVE-2026-25223: Fastify's Content-Type header tab character allows body validation bypass

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25223

CVE-2026-25223:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fastify	npm	< 5.7.2	5.7.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of the Content-Type HTTP header. Attackers could bypass request body validation by appending a tab character (\t) to a valid content type (e.g., Content-Type: application/json\tfoo).

The root cause was in the ContentTypeParser.getParser function, which incorrectly considered a tab character as a valid separator when matching a content type to a registered parser. This caused Fastify to select the correct parser (e.g., for application/json) and process the request body accordingly. However, the validation step would use the full, malformed content type string (application/json\tfoo) to look up a validation schema. Since no schema existed for this invalid type, validation was completely bypassed, while the application logic still received the parsed body, trusting it to have been validated.

The entry point for this vulnerability was the handleRequest function, which took the raw Content-Type header from the request and passed it down to the parsing and validation logic without initial sanitization.

The patch addresses this by introducing a new ContentType class that strictly parses and validates the header value against RFC specifications. The handleRequest function now uses this class to reject requests with invalid Content-Type headers upfront. Furthermore, all methods within the ContentTypeParser class, including getParser and add, were updated to use this new class to ensure that only valid and normalized content types are processed, effectively eliminating the parsing ambiguity that led to the bypass.

Vulnerable functions

handleRequest

lib/handle-request.js

This function is the entry point for handling requests. It was vulnerable because it accepted the 'content-type' header from the request without proper validation and passed it to the content type parser. This allowed a malformed header containing a tab character to be processed, leading to a bypass of body validation.

ContentTypeParser.getParser

lib/content-type-parser.js

This function was responsible for finding a parser for a given content type. The vulnerable version incorrectly treated a tab character as a valid separator. This allowed a request with a 'Content-Type' header like 'application/json\tfoo' to match the 'application/json' parser, enabling the body to be parsed as JSON. However, the validation schema lookup would use the full, invalid content type, fail to find a match, and consequently bypass the body validation.

ContentTypeParser.add

lib/content-type-parser.js

This function allows adding new content type parsers. It was vulnerable because it did not validate the content type string before adding a parser. This could allow a developer to inadvertently register a parser for a malformed content type, contributing to the overall weakness in content type handling. The patch enforces strict validation using the new `ContentType` class.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.