CVE-2026-33806: Fastify body schema validation bypass via leading space in Content-Type

CVE-2026-33806 · Severity: low · CVSS 3.1 · Published 2026-04-15

Executive brief

Fastify is a popular Node.js web framework used to build REST APIs and web applications. This vulnerability allows attackers to bypass request body validation by adding a single space character to the Content-Type header, enabling them to submit malformed or malicious data that should have been rejected. This could lead to data corruption, unauthorized state changes, or exploitation of downstream business logic that expects validated inputs.

Technical details

The vulnerability is a parser-validator differential in Fastify's Content-Type handling. The parser (lib/content-type.js) applies trimStart() before processing the header and correctly parses the body as JSON. However, the validator (lib/validation.js) splits on the regex /[ ;]/ before trimming, causing a leading space to become a split point that produces an empty string. The validator then looks up a schema for content-type "" (empty string), finds nothing, and skips validation entirely. This is a regression introduced by commit f3d2bcb which changed the split delimiter from ';' to /[ ;]/ to fix CVE-2025-32442. The old code applied trim() after splitting, preventing this attack. Exploitation requires only network access, no authentication or user interaction, and consists of modifying a single HTTP header. The fix is to add trimStart() before the split operation in getEssenceMediaType().

Affected products

OpenJS Foundation Fastify 5.3.2 through 5.8.4

CVE identifiers

CVE-2026-33806
CVE-2025-32442

Timeline

2026-04-15: disclosed: Advisory published on GitHub and OSV
2026-04-15: patched: Fixed in version 5.8.5
2025-04-18: other: Regression introduced by commit f3d2bcb attempting to fix CVE-2025-32442