CVEvulnerability

CVE-2026-33806

7.5 HIGH Published 2026-04-15 Modified 2026-07-15 Official page ↗
Status
Modified
Published
2026-04-15
Last modified
2026-07-15
Assigner
ce714d77-add3-4f53-aff5-83d477b104bb
CVSS 3.1 (ce714d77-add3-4f53-aff5-83d477b104bb)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1287, CWE-1289

Description

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.

Affected configurations

• fastify fastify (>= 5.3.2 < 5.8.5)

Related

Weakness · CWE (2)

  • CWE-1287 Improper Validation of Specified Type of Input weakness
  • CWE-1289 Improper Validation of Unsafe Equivalence in Input weakness

References