CVE-2026-25223

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25223", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-30T14:44:47.327Z", "datePublished": "2026-02-03T21:21:40.268Z", "dateUpdated": "2026-09-16T12:04:20.445Z"}, "containers": {"cna": {"title": "Fastify's Content-Type header tab character allows body validation bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-436", "lang": "en", "description": "CWE-436: Interpretation Conflict", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq"}, {"name": "https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821", "tags": ["x_refsource_MISC"], "url": "https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821"}, {"name": "https://hackerone.com/reports/3464114", "tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/3464114"}, {"name": "https://fastify.dev/docs/latest/Reference/Validation-and-Serialization", "tags": ["x_refsource_MISC"], "url": "https://fastify.dev/docs/latest/Reference/Validation-and-Serialization"}, {"name": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125", "tags": ["x_refsource_MISC"], "url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125"}, {"name": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272", "tags": ["x_refsource_MISC"], "url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272"}], "affected": [{"vendor": "fastify", "product": "fastify", "versions": [{"version": "< 5.7.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T21:21:40.268Z"}, "descriptions": [{"lang": "en", "value": "Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2."}], "source": {"advisory": "GHSA-jx2c-rxcm-jvmq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T21:18:10.359742Z", "id": "CVE-2026-25223", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:18:16.693Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.16::el8"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel8", "product": "Red Hat OpenShift AI 2.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1774282136", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776742021", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776742141", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3.27::el9"], "defaultStatus": "affected", "packageName": "devspaces/dashboard-rhel9", "product": "Red Hat OpenShift Dev Spaces 3.27", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1774476526", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/bootc-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/disk-image-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "datePublic": "2026-02-03T21:21:40.268Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Fastify, a web framework for Node.js. A remote attacker can exploit a validation bypass vulnerability by appending a tab character followed by arbitrary content to the Content-Type header. This circumvents the request body validation schemas, allowing the server to process the body as the original content type without proper validation. This could lead to unexpected data processing and potential integrity impact."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-179", "description": "Incorrect Behavior Order: Early Validation", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-25223"}, {"name": "RHBZ#2436560", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436560"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25223.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:5807"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:10184"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:6192"}], "solutions": [{"lang": "en", "value": "RHSA-2026:5807: Red Hat OpenShift AI 2.16"}, {"lang": "en", "value": "RHSA-2026:10184: Red Hat OpenShift AI 2.25"}, {"lang": "en", "value": "RHSA-2026:6192: Red Hat OpenShift Dev Spaces 3.27"}], "timeline": [{"lang": "en", "time": "2026-02-03T22:01:19.884Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-02-03T21:21:40.268Z", "value": "Made public."}], "title": "Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-16T12:04:20.445Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift_ai:2.16::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.16", "versions": [{"status": "unaffected", "version": "1774282136", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-dashboard-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.25", "versions": [{"status": "unaffected", "version": "1776742021", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-dashboard-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.25", "versions": [{"status": "unaffected", "version": "1776742141", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3.27::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces 3.27", "versions": [{"status": "unaffected", "version": "1774476526", "lessThan": "*", "versionType": "rpm"}], "packageName": "devspaces/dashboard-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/disk-image-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-02-03T22:01:19.884Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-02-03T21:21:40.268Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:5807: Red Hat OpenShift AI 2.16"}, {"lang": "en", "value": "RHSA-2026:10184: Red Hat OpenShift AI 2.25"}, {"lang": "en", "value": "RHSA-2026:6192: Red Hat OpenShift Dev Spaces 3.27"}], "x_adpType": "supplier", "datePublic": "2026-02-03T21:21:40.268Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-25223", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436560", "name": "RHBZ#2436560", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25223.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:5807", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:10184", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:6192", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Fastify, a web framework for Node.js. A remote attacker can exploit a validation bypass vulnerability by appending a tab character followed by arbitrary content to the Content-Type header. This circumvents the request body validation schemas, allowing the server to process the body as the original content type without proper validation. This could lead to unexpected data processing and potential integrity impact."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-179", "description": "Incorrect Behavior Order: Early Validation"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-16T12:04:20.445Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25223", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T21:18:10.359742Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:18:14.142Z"}}], "cna": {"title": "Fastify's Content-Type header tab character allows body validation bypass", "source": {"advisory": "GHSA-jx2c-rxcm-jvmq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "fastify", "product": "fastify", "versions": [{"status": "affected", "version": "< 5.7.2"}]}], "references": [{"url": "https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq", "name": "https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821", "name": "https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821", "tags": ["x_refsource_MISC"]}, {"url": "https://hackerone.com/reports/3464114", "name": "https://hackerone.com/reports/3464114", "tags": ["x_refsource_MISC"]}, {"url": "https://fastify.dev/docs/latest/Reference/Validation-and-Serialization", "name": "https://fastify.dev/docs/latest/Reference/Validation-and-Serialization", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125", "name": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272", "name": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-436", "description": "CWE-436: Interpretation Conflict"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T21:21:40.268Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25223", "state": "PUBLISHED", "dateUpdated": "2026-09-16T12:04:20.445Z", "dateReserved": "2026-01-30T14:44:47.327Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T21:21:40.268Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fastify", "vendor": "fastify", "versions": [{"status": "affected", "version": "< 5.7.2"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.16::el8"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel8", "product": "Red Hat OpenShift AI 2.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1774282136", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776742021", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776742141", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3.27::el9"], "defaultStatus": "affected", "packageName": "devspaces/dashboard-rhel9", "product": "Red Hat OpenShift Dev Spaces 3.27", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1774476526", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/bootc-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "packageName": "rhelai3/disk-image-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "51FAFCEB-4FBC-4777-BC6D-91713CA5828A", "versionEndExcluding": "5.7.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2."}, {"lang": "es", "value": "Fastify es un framework web r\u00e1pido y de baja sobrecarga, para Node.js. Antes de la versi\u00f3n 5.7.2, existe una vulnerabilidad de omisi\u00f3n de validaci\u00f3n en Fastify donde los esquemas de validaci\u00f3n del cuerpo de la solicitud especificados por Content-Type pueden ser completamente eludidos. Al a\u00f1adir un car\u00e1cter de tabulaci\u00f3n (\\t) seguido de contenido arbitrario al encabezado Content-Type, los atacantes pueden omitir la validaci\u00f3n del cuerpo mientras el servidor sigue procesando el cuerpo como el tipo de contenido original. Este problema ha sido parcheado en la versi\u00f3n 5.7.2."}], "id": "CVE-2026-25223", "lastModified": "2026-07-15T02:18:52.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25223", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T21:18:10.359742Z", "version": "2.0.3"}}]}, "published": "2026-02-03T22:16:31.130", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Technical Description"], "url": "https://fastify.dev/docs/latest/Reference/Validation-and-Serialization"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq"}, {"source": "security-advisories@github.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3464114"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:10184"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:5807"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:6192"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-25223"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436560"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25223.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-436"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-179"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact", "id": "2436560", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436560"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-179", "details": ["A flaw was found in Fastify, a web framework for Node.js. A remote attacker can exploit a validation bypass vulnerability by appending a tab character followed by arbitrary content to the Content-Type header. This circumvents the request body validation schemas, allowing the server to process the body as the original content type without proper validation. This could lead to unexpected data processing and potential integrity impact."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-25223", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-dashboard-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-dashboard-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-mod-arch-gen-ai-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-mod-arch-model-registry-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/dashboard-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-02-03T21:21:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-25223\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-25223\nhttps://fastify.dev/docs/latest/Reference/Validation-and-Serialization\nhttps://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125\nhttps://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272\nhttps://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821\nhttps://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq\nhttps://hackerone.com/reports/3464114"], "statement": "This IMPORTANT vulnerability in Fastify, a Node.js web framework, allows remote attackers to bypass request body validation by manipulating the Content-Type header. This can lead to unexpected data processing and integrity issues in applications. Red Hat products such as Red Hat Enterprise Linux AI, Red Hat OpenShift AI, and Red Hat OpenShift Dev Spaces are affected.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-18T00:00:45.230751+00:00", "value": {"mitigation_remediation": ["Upgrade Fastify to version 5.7.2 or newer, which eliminates the tab\u2011character flaw in the content\u2011type parser.", "Validate incoming Content\u2011Type headers server side and reject any value containing non\u2011ASCII whitespace such as tabs before processing the body.", "Apply application\u2011level input sanitization to all deserialized bodies and monitor logs for unexpected header anomalies to detect bypass attempts."], "summary": {"action": "Patch", "impact": "Validation Bypass"}, "threat_synthesis": {"affected_systems": "The flaw impacts any Fastify installation older than version 5.7.2. Releases from 5.7.2 onward include a patch that corrects the parser. Users of exact releases prior to 5.7.2 should review their application dependencies to determine the presence of the affected module.", "description_and_impact": "Fastify, a high\u2011performance Node.js web framework, suffers a validation bypass: by inserting a tab character after the MIME type in the Content\u2011Type header, an attacker can cause the framework to skip schema validation while still treating the payload as the declared type. This allows malicious data to reach downstream logic unfiltered, potentially leading to code injection or data corruption.", "risk_and_exploitability": "With a CVSS score of 7.5 the issue is high severity, yet the EPSS score of less than 1% indicates limited exploitation activity. The vulnerability is not catalogued in KEV. Attackers can exploit it by sending an HTTP request whose Content\u2011Type header contains a tab character; this requires no special authentication and is a low\u2011effort attack vector, after which arbitrary request bodies bypass validation."}}}}, "created": "2026-02-04T12:05:26.727842+00:00", "updated": "2026-04-18T00:15:31.768037+00:00", "vendors": ["fastify", "fastify$PRODUCT$fastify"]}