7.5
Élevée
CVE-2026-33806 Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed…
Description
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| fastify 5.8 | premières → < 5.8.5 | 5.8.5 |
| fastify 5.3 | 5.3.2 → < 5.8.5 | 5.8.5 |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions non publiées | |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées | |
| Red Hat OpenShift Dev Spaces | Versions non publiées |
Autres CVE de fastify
Les 17 CVE de fastify →
CVE-2026-120216
fastify is a web framework for Node.js
5.9
Moyenne
CVE-2026-107832
fastify is a fast and low overhead web framework for Node.js
3.7
Faible
CVE-2026-92081
fastify is a fast and low-overhead web framework for Node.js
5.9
Moyenne
CVE-2026-84428
fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a…
7.5
Élevée