Answer in brief
CVE-2026-25223 records a High severity (CVSS 7.5) vulnerability in Fastify's Content-Type header tab character allows body validation bypass. The current sources do not mark it as known exploited. The current feed maps fastify/fastify (generic), fastify (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps fastify/fastify (generic), fastify (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| fastify/fastifygeneric | < 5.7.2 | Not reported |
| fastifynpm | >=0 <5.7.2 | 5.7.2 |
Published upstream
Feb 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 15, 2026
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.
Quoted source text, attributed separately from HOL analysis.