CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
Attackers can bypass body schema validation in Fastify applications by adding a leading space to the Content-Type header, potentially allowing invalid data processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33806?
CVE-2026-33806 is a high-severity vulnerability in fastify, published on 15 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact:
Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped.
This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442
Patches:
Upgrade to fastify v5.8.5 or later.
Workarounds:
None. Upgrade to the patched version.
Which versions are affected by CVE-2026-33806?
It affects 1 product.
Products include Fastify Fastify.
How do I fix CVE-2026-33806?
Upgrade to a fixed version.
Is CVE-2026-33806 being exploited?
There is no known exploitation of CVE-2026-33806 in the wild and no public exploit code.
Other vulnerabilities in fastify
- CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision
- CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas
- CVE-2026-25223 Fastify's Content-Type header tab character allows body validation bypass
Sources
Also known as MINI-j3pc-8mch-536r.