CVE-2026-25223

{"id": "CVE-2026-25223", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25223", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T21:18:10.359742Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fastify", "product": "fastify", "versions": [{"status": "affected", "version": "< 5.7.2"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift_ai:2.16::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.16", "versions": [{"status": "unaffected", "version": "1774282136", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-dashboard-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.25", "versions": [{"status": "unaffected", "version": "1776742021", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-dashboard-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.25", "versions": [{"status": "unaffected", "version": "1776742141", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3.27::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces 3.27", "versions": [{"status": "unaffected", "version": "1774476526", "lessThan": "*", "versionType": "rpm"}], "packageName": "devspaces/dashboard-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/disk-image-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-02-03T22:16:31.130", "references": [{"url": "https://fastify.dev/docs/latest/Reference/Validation-and-Serialization", "tags": ["Product", "Technical Description"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3464114", "tags": ["Permissions Required"], "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:10184", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:5807", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:6192", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-25223", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436560", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25223.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-436"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-179"}]}], "descriptions": [{"lang": "en", "value": "Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2."}, {"lang": "es", "value": "Fastify es un framework web r\u00e1pido y de baja sobrecarga, para Node.js. Antes de la versi\u00f3n 5.7.2, existe una vulnerabilidad de omisi\u00f3n de validaci\u00f3n en Fastify donde los esquemas de validaci\u00f3n del cuerpo de la solicitud especificados por Content-Type pueden ser completamente eludidos. Al a\u00f1adir un car\u00e1cter de tabulaci\u00f3n (\\t) seguido de contenido arbitrario al encabezado Content-Type, los atacantes pueden omitir la validaci\u00f3n del cuerpo mientras el servidor sigue procesando el cuerpo como el tipo de contenido original. Este problema ha sido parcheado en la versi\u00f3n 5.7.2."}], "lastModified": "2026-07-15T02:18:52.920", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "51FAFCEB-4FBC-4777-BC6D-91713CA5828A", "versionEndExcluding": "5.7.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}