Vulnerability Details CVE-2026-33806
Impact:
Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped.
This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442
Patches:
Upgrade to fastify v5.8.5 or later.
Workarounds:
None. Upgrade to the patched version.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 12.9%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-33806
-
cpe:2.3:a:fastify:fastify:5.3.2
-
cpe:2.3:a:fastify:fastify:5.3.3
-
cpe:2.3:a:fastify:fastify:5.4.0
-
cpe:2.3:a:fastify:fastify:5.5.0
-
cpe:2.3:a:fastify:fastify:5.6.0
-
cpe:2.3:a:fastify:fastify:5.6.1
-
cpe:2.3:a:fastify:fastify:5.6.2
-
cpe:2.3:a:fastify:fastify:5.7.0
-
cpe:2.3:a:fastify:fastify:5.7.1
-
cpe:2.3:a:fastify:fastify:5.7.2
-
cpe:2.3:a:fastify:fastify:5.7.3
-
cpe:2.3:a:fastify:fastify:5.7.4
-
cpe:2.3:a:fastify:fastify:5.8.0
-
cpe:2.3:a:fastify:fastify:5.8.1
-
cpe:2.3:a:fastify:fastify:5.8.2
-
cpe:2.3:a:fastify:fastify:5.8.3
-
cpe:2.3:a:fastify:fastify:5.8.4