7.5
High
CVE-2026-33806 Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed…
Description
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| fastify 5.8 | earliest → < 5.8.5 | 5.8.5 |
| fastify 5.3 | 5.3.2 → < 5.8.5 | 5.8.5 |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published |
References
- github.com github.com
- cna.openjsf.org cna.openjsf.org
Timeline
- Published
- Last modified
Other CVEs of fastify
The 17 CVEs of fastify →
CVE-2026-120216
fastify is a web framework for Node.js
5.9
Medium
CVE-2026-107832
fastify is a fast and low overhead web framework for Node.js
3.7
Low
CVE-2026-92081
fastify is a fast and low-overhead web framework for Node.js
5.9
Medium
CVE-2026-84428
fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a…
7.5
High