CVE-2026-33806: Fastify

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.

Affected products

• Fastify Fastify: from 5.3.2, before 5.8.5 (fixed in 5.8.5)

Published 2026-04-15. Last modified 2026-07-15.