high7.5
CVE-2026-33806
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the …
Impact
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | fastify | >= 5.3.2, <= 5.8.4 | 5.8.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fastify | Fastify | from 5.3.2 before 5.8.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-247c-9743-5963
- https://github.com/fastify/fastify/security/advisories/GHSA-247c-9743-5963
- https://nvd.nist.gov/vuln/detail/CVE-2025-32442
- https://github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4
- https://github.com/fastify/fastify/releases/tag/v5.8.5
- https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc
- https://nvd.nist.gov/vuln/detail/CVE-2026-33806
- https://cna.openjsf.org/security-advisories.html
- https://access.redhat.com/security/cve/CVE-2026-33806
- https://bugzilla.redhat.com/show_bug.cgi?id=2458596
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json