CVE-2025-32442: Fastify Content-Type Parsing Vulnerability Leading to Validation Bypass
Summary
CVE-2025-32442: Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass. Affects fastify across 2 version ranges.
>= 4.29.0, < 4.29.1
>= 5.0.0, < 5.3.2
Fixed in 4.29.1 or 5.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js designed for building efficient and scalable server-side applications. It is known for its high performance and low overhead, making it a popular choice among developers. However, it has been identified that Fastify is vulnerable to invalid content-type parsing, which can lead to a bypass of validation mechanisms in applications that rely on specific content types for data validation.
Vulnerability Detail
The vulnerability arises when applications using Fastify specify different validation strategies for various content types. An attacker can exploit this by providing a slightly altered content type, such as changing the casing or adding whitespace before the semicolon. This can allow the attacker to bypass validation checks that are intended to enforce the structure and type of incoming data, potentially leading to unauthorized access or data manipulation.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.29.0, < 4.29.14.29.1npm install fastify@4.29.1 -
>= 5.0.0, < 5.3.25.3.2npm install fastify@5.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid specifying individual content types in the schema. Instead, use a more general schema definition. For example, replace the following code:
fastify.post('/', {
handler(request, reply) {
reply.code(200).send(request.body)
},
schema: {
body: {
content: {
'application/json': {
schema: {
type: 'object',
properties: {
'foo': {
type: 'string',
}
},
required: ['foo']
}
},
}
}
}
})
With this more general schema:
fastify.post('/', {
handler(request, reply) {
reply.code(200).send(request.body)
},
schema: {
body: {
type: 'object',
properties: {
'foo': {
type: 'string',
}
},
required: ['foo']
}
}
})
Conclusion
In summary, CVE-2025-32442 is a significant vulnerability in Fastify that can lead to validation bypass through improper content-type parsing. Users are encouraged to update to the latest version to mitigate this risk and ensure the integrity of their applications.
See every vulnerability recorded for fastify →
FAQ
CVE-2025-32442 is a vulnerability in Fastify that allows attackers to bypass validation by exploiting content-type parsing.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
The consequences include potential unauthorized access or manipulation of data due to bypassed validation checks.
You can update Fastify by running the command 'npm install fastify@5.3.1' in your terminal.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
