CVE-2026-33806

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

Impact:

Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped.

This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442

Patches:

Upgrade to fastify v5.8.5 or later.

Workarounds:

None. Upgrade to the patched version.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-1287 CWE-1289

Affected software

Vendor	Product	Versions
fastify	fastify	>= 5.3.2, < 5.8.5
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift Dev Spaces	—

References

Timeline

Published: Apr 15, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-338079.1@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when CVE-2026-338089.1Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalizatio CVE-2026-338095.3A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consump CVE-2026-33819.8Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the z CVE-2026-338108.2When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs whi CVE-2026-338117.5When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.CVE-2026-338126.1Parsing a malicious font file can cause excessive memory allocation.CVE-2026-338137.5Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.CVE-2026-338147.5When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_F CVE-2026-338159.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338169.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338187.5Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.