npm/fastify CVE-2025-32442, CVE-2026-33806: high 7.5, EPSS 0.73%
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
Action: Upgrade fastify to 4.29.1 or later.
npm i fastify@5.3.2npm i fastify@4.29.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.3.2 | - |
| 4.29.0 | 4.29.1 | - |
Fixed versions
| 5.3.2 | 4.29.1 |
Sources
- osv: GHSA-mg2h-6x62-wpwc
- https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc
- https://nvd.nist.gov/vuln/detail/CVE-2025-32442
- https://github.com/fastify/fastify/commit/436da4c06dfbbb8c24adee3a64de0c51e4f47418
- https://github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4
- https://hackerone.com/reports/3087928
- https://github.com/fastify/fastify
CVE-2025-32442, CVE-2026-33806 · published · modified · JSON