EUVD-2026-22818
GHSA-247c-9743-5963
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft HTTP request with leading-space Content-Type header
-
DeliverySend malicious payload violating expected schema
-
ExploitFastify parser processes body correctly
-
InstallValidation layer fails to match content-type
-
C2Schema validation completely skipped
-
ExecuteMalicious unvalidated data reaches application logic
-
ImpactTrigger secondary vulnerabilities or business logic violations
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Specified type validation
|
| Exploitation Conditions | Fastify applications version 5.3.2 through 5.8.4 using schema.body.content for per-content-type body validation. Remote unauthenticated attacker sends HTTP request with space-prepended Content-Type header (e.g., ' application/json'). No victim interaction required. |
| Impact | The CVSS 3.1 score of 7.5 (High) reflects network-exploitable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack characteristics with high integrity impact (I:H) but no confidentiality or availability impact. Real-world risk is elevated for applications relying on schema.body.content as a security control for business logic validation, API contract enforcement, or preventing injection attacks through strict input typing. The attack requires only HTTP header manipulation, which is trivial to execute and fully automatable, increasing SSVC automatable score. However, exploitation impact depends heavily on downstream code behavior-applications that perform additional validation or use type-safe operations may have defense-in-depth mitigations. The regression nature (introduced by security fix for CVE-2025-32442) suggests affected version window is limited to Fastify 5.3.2-5.8.4, reducing exposure compared to long-standing vulnerabilities. No public exploit code or confirmed active exploitation tempers immediate urgency, but the low attack complexity and authentication-free nature warrant priority patching for internet-facing Fastify applications using content-type-specific validation. |
| Exploit ScenarioDerived | An attacker targets a Fastify API endpoint configured with schema.body.content validation requiring strict JSON schemas for application/json requests. The attacker crafts an HTTP POST request with Content-Type header value ' application/json' (with leading space) and includes a malicious payload violating the expected schema-such as SQL injection strings in fields typed as integers, or XXE payloads in fields expecting sanitized strings. The validation layer fails to match ' application/json' to the configured schema, skipping all checks, while the body parser correctly interprets the content type and processes the malicious payload. The application logic receives unvalidated, potentially malicious data that should have been rejected, leading to data corruption, business logic bypass, or secondary injection vulnerabilities. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 15, 2026
Remote validation bypass in Fastify 5.3.2+ allows unauthenticated attackers to bypass per-content-type body schema validation by prepending a single space character to the Content-Type HTTP header. Applications using schema.body.content for request validation accept malformed or malicious payloads that should be rejected, enabling data integrity violations. This regression was introduced by the fix for CVE-2025-32442. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis. Affects Fastify web framework version 5.3.2 through 5.8.4.
RemediationAI
Upgrade to Fastify version 5.8.5 or later, which contains the complete fix for the header parsing inconsistency. The vendor explicitly states no workarounds are available, making immediate upgrade the only remediation path. Node.js package managers can upgrade via 'npm update fastify@5.8.5' or 'yarn upgrade fastify@5.8.5'. Organizations unable to upgrade immediately should audit all Fastify route handlers using schema.body.content configuration and implement additional server-side validation or input sanitization as compensating controls, though this does not fully mitigate the vulnerability. Reference the OpenJS Foundation security advisory at https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc and https://cna.openjsf.org/security-advisories.html for complete vendor guidance and verification of patched deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fastify is a high-performance Node.js web framework supporting JSON Schema-based request validation. The vulnerability targets applications using the schema.body.content configuration for content-type-specific body validation, where different schemas can be applied based on Content-Type headers (e.g., application/json vs multipart/form-data). The CWE-1287 classification indicates improper validation of specified type of input, specifically a header parsing inconsistency. The framework's Content-Type matching logic fails when the header value contains leading whitespace, causing a mismatch between the parsing layer (which correctly handles ' application/json') and the validation layer (which expects 'application/json'). This creates a parsing differential where the body is processed according to the content type but validation is entirely skipped, violating the principle of defense in depth in input validation pipelines.
Know when Fastify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
Impact:
Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped.
This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442
Patches:
Upgrade to fastify v5.8.5 or later.
Workarounds:
None. Upgrade to the patched version.
Blast Radius
ecosystem impact- 18 npm packages depend on fastify (14 direct, 4 indirect)
Ecosystem-wide dependent count for version 5.3.2.
Executive ViewAI
Fastify versions 5.3.2 through 5.8.4 contain a critical request validation bypass that allows unauthenticated attackers to submit malformed payloads that should be rejected by schema validation, directly compromising data integrity and application security controls. Organizations running affected Fastify versions are exposed to injection attacks, malicious data ingestion, and bypass of business logic protections without requiring authentication or user credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement strict Content-Type header validation at ingress layer (WAF/API gateway) to reject headers containing leading/trailing whitespace; (2) Enable request body size limits and rate limiting to constrain injection attack surface; (3) Add application-level input validation redundancy independent of Fastify schema validation; (4) Monitor request logs for Content-Type headers with anomalous spacing patterns; (5) Consider temporary pinning to Fastify 5.3.1 or earlier stable version if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all req
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
Fastify is a fast and low overhead web framework, for Node.js. Rated high severity (CVSS 7.5), this vulnerability is rem
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: a
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger reso
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Authorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthent
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authoriza
Fastify is a web framework with minimal overhead and plugin architecture. Rated high severity (CVSS 8.8), this vulnerabi
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Exploit-DB