Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-33806 Details

Description

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: redhat-SADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://access.redhat.com/security/cve/CVE-2026-33806	redhat-SADP
https://bugzilla.redhat.com/show_bug.cgi?id=2458596	redhat-SADP
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json	redhat-SADP
https://cna.openjsf.org/security-advisories.html	openjs	Vendor Advisory
https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc	openjs	Not Applicable

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-1287	Improper Validation of Specified Type of Input	openjs
CWE-1289	Improper Validation of Unsafe Equivalence in Input	redhat-SADP

Affected Products

Product	Versions
fastify fastify	>= 5.3.2, < 5.8.5
CPE cpe:2.3:a:fastify:fastify::::::node.js::* Remediation No remediation found in references.

Change History

6 change records found show changes

Date	Action	Recorded By
Jul 15, 2026	CVE Modified	redhat-SADP
Jun 30, 2026	CVE Modified	redhat-SADP
Jun 17, 2026	CVE Modified	openjs
Jun 17, 2026	CVE Modified	CISA-ADP
Apr 17, 2026	Initial Analysis	[email protected]
Apr 15, 2026	New CVE Received	openjs