« Volver al listado

CVE-2025-32442

Estado: ModificadaAlta (7.5)—

Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different validation strategies for different content types have a possibility to bypass validation by providing a _slightly altered_ content type such as with different casing or altered whitespacing before `;`. This was patched in v5.3.1, but the initial patch did not cover all problems. This has been fully patched in v5.3.2 and v4.29.1. A workaround involves not specifying individual content types in the schema.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Bypass de validación en Fastify mediante alteración de Content-Type (AV:N, PR:N, UI:N). Permite inyectar datos no validados (I:H) que corrompen la integridad de la aplicación web.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficEncrypt Sensitive Information

Tecnologías afectadas (1)

Fastify — Fastify

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32442",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32442",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-21T13:28:27.299500Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "fastify",
          "product": "fastify",
          "versions": [
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.3.2"
            },
            {
              "status": "affected",
              "version": "= 4.29.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-18T16:15:23.327",
  "references": [
    {
      "url": "https://github.com/fastify/fastify/commit/436da4c06dfbbb8c24adee3a64de0c51e4f47418",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://hackerone.com/reports/3087928",
      "tags": [
        "Permissions Required"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different validation strategies for different content types have a possibility to bypass validation by providing a _slightly altered_ content type such as with different casing or altered whitespacing before `;`. This was patched in v5.3.1, but the initial patch did not cover all problems. This has been fully patched in v5.3.2 and v4.29.1. A workaround involves not specifying individual content types in the schema."
    },
    {
      "lang": "es",
      "value": "Fastify es un framework web rápido y de bajo consumo para Node.js. En las versiones 5.0.0 a 5.3.0, las aplicaciones que especifican diferentes estrategias de validación para distintos tipos de contenido pueden omitir la validación proporcionando un tipo de contenido ligeramente modificado, como con mayúsculas y minúsculas diferentes o con espacios antes de `;` modificados. Esto se solucionó en la versión 5.3.1, pero la corrección inicial no solucionó todos los problemas. Se ha corregido completamente en la versión 5.3.2. Un workaround consiste en no especificar tipos de contenido individuales en el esquema."
    }
  ],
  "lastModified": "2026-06-17T09:12:00.070",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C3A81A7-33F6-491A-992C-FBD944597D42",
              "versionEndExcluding": "5.3.2",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fastify:fastify:4.29.0:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10266904-B1D6-47CF-8F45-18FB744FC761"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}