Vulnerability in Fastify Applications Affecting Content-Type Validation

CVE-2026-33806

What is CVE-2026-33806?

A vulnerability exists in Fastify applications that utilize schema.body.content for body validation per content type. An attacker can exploit this issue by prepending a space to the Content-Type header, leading to the bypass of validation checks without compromising the body parsing. This security flaw was introduced in Fastify version 5.3.2 as a regression from a previous fix. To mitigate this issue, users are advised to upgrade to Fastify version 5.8.5 or higher, as there are currently no workarounds available.

References