# CVE-2026-33806: Fastify schema validation bypass via malformed Content-Type header

Source: https://junglewise.ai/threats/cve-2026-33806-fastify-schema-validation-bypass-via-malformed-content-type  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-15. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33806 · Severity: high · CVSS 7.5 · Published 2026-04-15

Fastify, a popular web framework for Node.js, contains a vulnerability that allows attackers to bypass data validation checks. By slightly modifying the format of a request, an attacker can submit data that skips security and integrity rules while still being processed by the application. This could lead to the processing of malicious or malformed data that the application expects to be filtered.

Technologies: [fastify (npm)](https://junglewise.ai/threats/technologies/fastify). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-33806 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33806 being exploited in the wild.

**How severe is CVE-2026-33806?** High severity, with a CVSS score of 7.5, published 15 April 2026.

**Which products and versions are affected?** fastify (npm) >= 5.3.2, <= 5.8.4, SEMVER:introduced=5.3.2,fixed=5.8.5.

**Is there a fix for CVE-2026-33806?** Yes. fastify (npm): upgrade to 5.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33806 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33806?** Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fastify (npm): upgrade to 5.8.5 or later

  ```sh
  npm install fastify@5.8.5
  ```


## Technical details

A regression in Fastify's request handling allows for a schema validation bypass when using 'schema.body.content' for per-content-type validation. By prepending a space to the 'Content-Type' header (e.g., ' application/json'), the framework correctly identifies the parser but fails to match the associated validation schema. This results in the request body being parsed and passed to the route handler without undergoing the intended schema validation. This issue was introduced in version 5.3.2 as a side effect of a previous security fix and is resolved in version 5.8.5.

## Affected products

- fastify fastify >= 5.3.2, < 5.8.5

## Identifiers

- CVE-2026-33806
- GHSA-247c-9743-5963

## Timeline

- 2026-04-14: disclosed
- 2026-04-15: advisory

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc](https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc)
- [https://access.redhat.com/security/cve/CVE-2026-33806](https://access.redhat.com/security/cve/CVE-2026-33806)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2458596](https://bugzilla.redhat.com/show_bug.cgi?id=2458596)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33806.json)

## Related threats

- [fastify is vulnerable to header validation bypass via case-sensitive propertyNames](https://junglewise.ai/threats/cve-2026-107832-fastify-is-a-fast-and-low-overhead-web-framework-for-node-js-in)
- [Fastify denial of service via unhandled exception on HTTP/2 trailer responses](https://junglewise.ai/threats/cve-2026-92081-fastify-denial-of-service-via-unhandled-exception-on-http-2)
- [Fastify header validation bypass via incomplete schema case normalization](https://junglewise.ai/threats/cve-2026-84428-fastify-header-validation-bypass-via-incomplete-schema-case)
- [Fastify request body replacement via async validation result collision](https://junglewise.ai/threats/cve-2026-84504-fastify-request-body-replacement-via-async-validation-result)
- [Fastify request validation bypass via skipped boolean false schemas](https://junglewise.ai/threats/cve-2026-84469-fastify-request-validation-bypass-via-skipped-boolean-false)