Description (CNA)
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| fastify / fastify | affected 5.3.2 before 5.8.5; unaffected 5.8.5 |
CWE
CWE-1287
References
- https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc
- https://cna.openjsf.org/security-advisories.html
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Fastify. A remote attacker could exploit this vulnerability by prepending a space to the Content-Type header in a request. This action bypasses the application's schema validation, allowing the attacker to submit data that would otherwise be rejected. This could lead to unexpected data processing and potential integrity issues within the application.