Cyber Resilience

CVE-2025-32442

Fastify 5.0.0 – 5.3.2

Public PoC
Published
18 April 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0071 50th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-32442 is a high-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Fastify Fastify. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 50th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different validation strategies for different content types have a possibility to bypass validation by providing a…

more

_slightly altered_ content type such as with different casing or altered whitespacing before `;`. This was patched in v5.3.1, but the initial patch did not cover all problems. This has been fully patched in v5.3.2 and v4.29.1. A workaround involves not specifying individual content types in the schema.

CWE(s)
CWE-1287

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability in Fastify enables remote attackers to bypass input validation schemas by manipulating Content-Type headers (e.g., casing or whitespace changes), facilitating exploitation of public-facing web applications.

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0051: LLM Prompt InjectionAML.T0018: Manipulate AI ModelAML.T0024: Exfiltration via AI Inference API

CVEs Like This One

CVE-2026-33806Same product: Fastify Fastify
CVE-2026-3419Same product: Fastify Fastify
CVE-2026-25223Same product: Fastify Fastify
CVE-2026-3635Same product: Fastify Fastify
CVE-2026-25224Same product: Fastify Fastify
CVE-2026-33807Same vendor: Fastify
CVE-2026-15631Same vendor: Fastify
CVE-2026-16117Same vendor: Fastify
CVE-2026-33805Same vendor: Fastify
CVE-2025-66415Same vendor: Fastify

Affected Assets

fastify
fastify
4.29.0 · 5.0.0 — 5.3.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-2 Flaw Remediation
  • AC-3 Access Enforcement
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.1.1
  • V1.4.2
  • V2.1.1
  • V2.2.2

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of content-type inputs to reject malformed or variant header values that bypass schema checks.

SI-2 Flaw Remediation good match
prevent

Mandates timely application of patches that correct the incomplete content-type canonicalization logic in Fastify 5.3.2/4.29.1.

AC-3 Access Enforcement partial match
prevent

Enforces access decisions only after content-type validation succeeds, blocking requests that exploit the casing/whitespace bypass.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper input type validation during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect type-validation flaws but does not prevent them during development.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates input validation and type checking to prevent improper type handling.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly include validation of input data types and formats.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles promote defensive input handling and type enforcement at system boundaries.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly require proper type validation of all external inputs.

References