What is the CVSS score of CVE-2026-25223?

CVE-2026-25223 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-25223?

Fastify versions prior to 5.7.2 contain a validation bypass vulnerability that allows attackers to circumvent request body validation controls, potentially enabling injection attacks, data…. A patch is available.

How to fix or mitigate CVE-2026-25223?

Within 24 hours: Inventory all applications using Fastify and identify those running versions prior to 5.7.2; assess exposure by determining if affected services process untrusted external input. Within 7 days: Deploy Fastify 5.7.2 or later across development and staging environments; conduct regression testing of request validation logic. Within 30 days: Complete production deployment of patched versions; validate that all Content-Type validation schemas are functioning as intended post-upgrade.

Node.js CVE-2026-25223

HIGH

Interpretation Conflict (CWE-436)

2026-02-03 security-advisories@github.com

GHSA-jx2c-rxcm-jvmq

Authentication Bypass Node.js Fastify

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 10, 2026 - 20:05 nvd

Patch available

CVE Published

Feb 03, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.

AnalysisAI

Fastify versions before 5.7.2 allow attackers to bypass request body validation by injecting a tab character into the Content-Type header, enabling malicious payloads to reach application logic without validation checks. This remote attack requires no authentication and affects Node.js applications using vulnerable Fastify versions. A patch is available in version 5.7.2 and later.

Technical ContextAI

Classified as CWE-436 (Interpretation Conflict). Affects Fastify. Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.