Executive brief
Fastify, a popular web framework for Node.js, contains a vulnerability that allows attackers to bypass data validation checks. By slightly modifying the format of a request, an attacker can submit data that skips security and integrity rules while still being processed by the application. This could lead to the processing of malicious or malformed data that the application expects to be filtered.
Technical details
A regression in Fastify's request handling allows for a schema validation bypass when using 'schema.body.content' for per-content-type validation. By prepending a space to the 'Content-Type' header (e.g., ' application/json'), the framework correctly identifies the parser but fails to match the associated validation schema. This results in the request body being parsed and passed to the route handler without undergoing the intended schema validation. This issue was introduced in version 5.3.2 as a side effect of a previous security fix and is resolved in version 5.8.5.
Affected products
- fastify fastify >= 5.3.2, < 5.8.5
Timeline
- 2026-04-14: disclosed
- 2026-04-15: advisory
References
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc
- https://access.redhat.com/security/cve/CVE-2026-33806
- https://bugzilla.redhat.com/show_bug.cgi?id=2458596
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json