SB20260414103 - Improper Validation of Specified Type of Input in Fastify

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Validation of Specified Type of Input (CVE-ID: CVE-2025-32442)

CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass validation.

The vulnerability exists due to improper validation of syntactic correctness in content-type parsing when handling requests with slightly altered content-type values. A remote attacker can send a specially crafted request to bypass validation.

Only applications that define different validation strategies for different content types in the request body schema are affected.

Remediation

Install update from vendor's website.

References

• https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc
• https://hackerone.com/reports/3087928