REDHAT-BUG-2458596: High severity fastify Fastify vulnerability
Impact:
Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped.
This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442
Patches:
Upgrade to fastify v5.8.5 or later.
Workarounds:
None. Upgrade to the patched version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fastifyto a version that resolves this vulnerability.Fixed in 5.8.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2458596?
The severity of REDHAT-BUG-2458596 is categorized as high with a score of 7.
How do I fix REDHAT-BUG-2458596?
To fix REDHAT-BUG-2458596, upgrade Fastify to the latest version that addresses the regression issue.
What impact does REDHAT-BUG-2458596 have on my application?
REDHAT-BUG-2458596 allows for validation bypass in Fastify applications when a space is prepended to the Content-Type header.
Which versions of Fastify are affected by REDHAT-BUG-2458596?
REDHAT-BUG-2458596 affects Fastify versions 5.3.2 and above.
Is REDHAT-BUG-2458596 a known regression issue?
Yes, REDHAT-BUG-2458596 is a regression issue introduced in Fastify version 5.3.2.