Is CVE-2026-33806 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33806 being exploited in the wild.

How severe is CVE-2026-33806?

High severity, with a CVSS score of 7.5, published 15 April 2026.

Which products and versions are affected?

fastify (npm) >= 5.3.2, <= 5.8.4, SEMVER:introduced=5.3.2,fixed=5.8.5.

Is there a fix for CVE-2026-33806?

Yes. fastify (npm): upgrade to 5.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33806 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33806?

Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33806: Fastify schema validation bypass via malformed Content-Type header

Q: Is there a fix for CVE-2026-33806?

Yes. fastify (npm): upgrade to 5.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33806 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33806?

Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33806 · Severity: high · CVSS 7.5 · Published 2026-04-15

Fastify, a popular web framework for Node.js, contains a vulnerability that allows attackers to bypass data validation checks. By slightly modifying the format of a request, an attacker can submit data that skips security and integrity rules while still being processed by the application. This could lead to the processing of malicious or malformed data that the application expects to be filtered.

Technologies: fastify (npm). Vendors: npm.

Quick answers

Is CVE-2026-33806 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33806 being exploited in the wild.
How severe is CVE-2026-33806?: High severity, with a CVSS score of 7.5, published 15 April 2026.
Which products and versions are affected?: fastify (npm) >= 5.3.2, <= 5.8.4, SEMVER:introduced=5.3.2,fixed=5.8.5.
Is there a fix for CVE-2026-33806?: Yes. fastify (npm): upgrade to 5.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33806 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33806?: Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fastify (npm): upgrade to 5.8.5 or later
```
npm install fastify@5.8.5
```

Technical details

A regression in Fastify's request handling allows for a schema validation bypass when using 'schema.body.content' for per-content-type validation. By prepending a space to the 'Content-Type' header (e.g., ' application/json'), the framework correctly identifies the parser but fails to match the associated validation schema. This results in the request body being parsed and passed to the route handler without undergoing the intended schema validation. This issue was introduced in version 5.3.2 as a side effect of a previous security fix and is resolved in version 5.8.5.

Affected products

fastify fastify >= 5.3.2, < 5.8.5

Identifiers

CVE-2026-33806
GHSA-247c-9743-5963

Timeline

2026-04-14: disclosed
2026-04-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.