{"id":"CVE-2026-33806","state":"PUBLISHED","title":"fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header","description":"Impact:\n\nFastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped.\n\nThis is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442\n\nPatches:\n\nUpgrade to fastify v5.8.5 or later.\n\nWorkarounds:\n\nNone. Upgrade to the patched version.","publishedAt":"2026-04-15T00:14:02.376Z","updatedAt":"2026-07-15T01:06:02.186Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"openjs"},"assigner":"openjs","products":["fastify fastify"],"affected":[{"vendor":"fastify","product":"fastify","packageURL":"pkg:npm/fastify","defaultStatus":"unaffected","versions":[{"version":"5.3.2","status":"affected","lessThan":"5.8.5","versionType":"semver"},{"version":"5.8.5","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc","https://cna.openjsf.org/security-advisories.html","https://access.redhat.com/security/cve/CVE-2026-33806","https://bugzilla.redhat.com/show_bug.cgi?id=2458596","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json"],"weaknesses":["CWE-1287","CWE-1289"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/33xxx/CVE-2026-33806.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-33806","state":"PUBLISHED","datePublished":"2026-04-15T00:14:02.376Z","dateUpdated":"2026-07-15T01:06:02.186Z","assignerShortName":"openjs","assignerOrgId":"ce714d77-add3-4f53-aff5-83d477b104bb","dateReserved":"2026-03-23T19:48:48.715Z"},"containers":{"cna":{"title":"fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header","descriptions":[{"lang":"en","value":"Impact:\n\nFastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped.\n\nThis is a regression introduced in fastify >= 5.3.2 by the fix for CVE-2025-32442\n\nPatches:\n\nUpgrade to fastify v5.8.5 or later.\n\nWorkarounds:\n\nNone. Upgrade to the patched version."}],"affected":[{"vendor":"fastify","product":"fastify","packageURL":"pkg:npm/fastify","defaultStatus":"unaffected","versions":[{"version":"5.3.2","status":"affected","lessThan":"5.8.5","versionType":"semver"},{"version":"5.8.5","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc"},{"url":"https://cna.openjsf.org/security-advisories.html"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1287","lang":"en","description":"CWE-1287: Improper Validation of Specified Type of Input","type":"CWE"}]}],"providerMetadata":{"shortName":"openjs","orgId":"ce714d77-add3-4f53-aff5-83d477b104bb","dateUpdated":"2026-04-15T00:14:02.376Z"},"credits":[{"lang":"en","type":"remediation developer","value":"mcollina"},{"lang":"en","type":"remediation reviewer","value":"climba03003"},{"lang":"en","type":"remediation reviewer","value":"jsumners"},{"lang":"en","type":"remediation reviewer","value":"UlisesGascon"},{"lang":"en","type":"reporter","value":"Vyntral"}],"x_generator":{"engine":"cve-kit 1.0.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-15T14:02:12.644507Z","id":"CVE-2026-33806","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-15T16:13:42.961Z"}},{"title":"fastify: Fastify: Schema validation bypass via malformed Content-Type header","descriptions":[{"lang":"en","value":"A flaw was found in Fastify. A remote attacker could exploit this vulnerability by prepending a space to the Content-Type header in a request. This action bypasses the application's schema validation, allowing the attacker to submit data that would otherwise be rejected. This could lead to unexpected data processing and potential integrity issues within the application."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-cuda-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-rocm-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/disk-image-cuda-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-dashboard-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-dashboard-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-maas-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/dashboard-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-33806","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458596","name":"RHBZ#2458596","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1289","description":"Improper Validation of Unsafe Equivalence in Input","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:06:02.186Z"},"datePublic":"2026-04-15T00:14:02.376Z","timeline":[{"lang":"en","time":"2026-04-15T02:01:50.548Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-15T00:14:02.376Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}