CVE-2026-33806

Published: Apr 15, 2026Modified: Jul 15, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: ce714d77-add3-4f53-aff5-83d477b104bb (Secondary)

Description

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.

Affected (1)

Products: Fastify: Fastify

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fastify Fastify	From 5.3.2 to 5.8.5

Related CWEs

Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Improper Validation of Unsafe Equivalence in Input

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

References (5)

https://cna.openjsf.org/security-advisories.html

Source: ce714d77-add3-4f53-aff5-83d477b104bb

Vendor Advisory

https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc

Source: ce714d77-add3-4f53-aff5-83d477b104bb

Not Applicable

https://access.redhat.com/security/cve/CVE-2026-33806

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2458596

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.