Fastify, a high‑performance Node.js web framework, suffers a validation bypass: by inserting a tab character after the MIME type in the Content‑Type header, an attacker can cause the framework to skip schema validation while still treating the payload as the declared type. This allows malicious data to reach downstream logic unfiltered, potentially leading to code injection or data corruption.

The flaw impacts any Fastify installation older than version 5.7.2. Releases from 5.7.2 onward include a patch that corrects the parser. Users of exact releases prior to 5.7.2 should review their application dependencies to determine the presence of the affected module.

With a CVSS score of 7.5 the issue is high severity, yet the EPSS score of less than 1% indicates limited exploitation activity. The vulnerability is not catalogued in KEV. Attackers can exploit it by sending an HTTP request whose Content‑Type header contains a tab character; this requires no special authentication and is a low‑effort attack vector, after which arbitrary request bodies bypass validation.