CVE-2026-33806: fastify
Vulnerability summary
CVE-2026-33806 is a high (CVSS 7.5) vulnerability in fastify. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.4% of scored vulnerabilities.
Timeline
- 15-04-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.04 pp
From 0.45% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1287Improper Validation of Specified Type of InputThe product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
- CWE-1289Improper Validation of Unsafe Equivalence in InputThe product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Affected systems
Fastify1 product
- fastify≥ 5.3.2, < 5.8.5
1 vendor · 1 product