CVE-2026-33806
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.
Schwachstellenklasse
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.
Betroffene Produkte
- fastify fastify
Quellen
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc
- https://access.redhat.com/security/cve/CVE-2026-33806
- https://bugzilla.redhat.com/show_bug.cgi?id=2458596
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.