CVE-2026-33806

EUVD-2026-22818
Impact:

Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped.

This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442

Patches:

Upgrade to fastify v5.8.5 or later.

Workarounds:

None. Upgrade to the patched version.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
openjsCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
fastifyfastify
5.3.2 ≤
𝑥
< 5.8.5
CNA
Common Weakness Enumeration
References
https://cna.openjsf.org/security-advisories.html
https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc