CVE catalog
CVE-2026-33806
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still p
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.45% · Oct 25, 2026
A flaw was found in Fastify. A remote attacker could exploit this vulnerability by prepending a space to the Content-Type header in a request. This action bypasses the application's schema validation, allowing the attacker to submit data that would otherwise be rejected. This could lead to unexpected data processing and potential integrity issues within the application. fastify: Fastify: Schema validation bypass via malformed Content-Type header This vulnerability doesn't affect any supported Red Hat product. This happens because or either the vulnerability was introduced in a version later than the shipped one or the product is already shipping a patched version of Fastify. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | fastify | Not reported | 5.8.5 | fixed |
| Npm | fastify | Not reported | 5.8.5 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | fastify | cpe | Not reported | 5.8.5 | Not reported | Not reported | Not reported |
| Npm | fastify | npm | Not reported | 5.8.5 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-33806]
- [https://osv.dev/vulnerability/GHSA-247c-9743-5963]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json]
[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]