CVE-2026-33806
Fixed upstream EPSS <1%CVSS 7.5
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442 Patches: Upgrade to fastify v5.8.5 or later. Workarounds: None. Upgrade to the patched version.
Products: fastify, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | fastify | 5.8.5 |
| npm | fastify | 5.3.2 |
| npm | fastify | 4.29.1 |