Content-Type Header Tab Character Vulnerability in Fastify
Summary
GHSA-jx2c-rxcm-jvmq: Fastify's Content-Type header tab character allows body validation bypass. Affects fastify versions < 5.7.2. Fixed in 5.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js that is designed to be fast and low overhead. It provides a robust set of features for building web applications and APIs, including schema-based validation for request bodies. Fastify's reliance on Content-Type headers for body validation makes it susceptible to certain types of attacks, particularly those that exploit header manipulation.
Vulnerability Detail
A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character ('\t') followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas. This issue is a regression or missed edge case from the fix for a previously reported vulnerability.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.7.2
This is the first release that contains the fix.
npm install fastify@5.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can implement a custom 'onRequest' hook to reject requests containing tab characters in the Content-Type header. Here is an example of how to do this in your Fastify application:
fastify.addHook('onRequest', async (request, reply) => {
const contentType = request.headers['content-type'];
if (contentType && contentType.includes('\t')) {
reply.code(400).send({ error: 'Invalid Content-Type header' });
}
});
Conclusion
The Content-Type header tab character vulnerability in Fastify poses a significant risk to applications relying on body validation through Content-Type headers. Users are strongly encouraged to upgrade to the patched version 5.7.2 or implement the provided workaround to mitigate this risk.
See every vulnerability recorded for fastify →
FAQ
The vulnerability allows attackers to bypass request body validation by manipulating the Content-Type header.
If your application relies on Content-Type for body validation, it may process invalid data, leading to potential security risks.
All versions of Fastify prior to 5.7.2 are affected by this vulnerability.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
