CVE-2026-33806: Fastify Body Schema Validation Bypass via Leading Space in Content-Type Header
Summary
CVE-2026-33806: Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header. Affects fastify versions >= 5.3.2, < 5.8.5. Fixed in 5.8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js that is designed to be fast and low overhead. It provides a robust set of features for building web applications and APIs, including schema-based validation for request bodies. This framework is widely used for its performance and ease of use, but it has a vulnerability that can compromise data integrity when validating request bodies.
Vulnerability Detail
A validation bypass vulnerability exists in Fastify v5.x where request body validation schemas specified via schema.body.content can be completely circumvented by prepending a single space character to the Content-Type header. This issue arises from a regression introduced by a commit that altered how the Content-Type header is processed, leading to a parser-validator differential. The vulnerability allows attackers to bypass all body validation by simply adding a leading space, which can have serious implications for data integrity and security in applications relying on Fastify for validation.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.8.5
This is the first release that contains the fix.
npm install fastify@5.8.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the getEssenceMediaType function in the validation.js file to include trimStart() before the split operation. Here is the modified code:
function getEssenceMediaType(header) {
if (!header) return '';
return header.trimStart().split(/[ ;]/, 1)[0].trim().toLowerCase();
}
Conclusion
The CVE-2026-33806 vulnerability in Fastify poses a significant risk by allowing attackers to bypass body schema validation through a simple modification of the Content-Type header. It is crucial for developers using Fastify to update to the patched version and consider implementing the recommended workaround until they can upgrade.
See every vulnerability recorded for fastify →
FAQ
CVE-2026-33806 is a vulnerability in Fastify that allows for body schema validation to be bypassed by adding a leading space in the Content-Type header.
If your application relies on Fastify for validating request bodies, this vulnerability can allow attackers to send invalid data without triggering validation errors.
Fastify versions 5.3.2 to 5.8.4 are affected by this vulnerability. Version 5.8.5 and later contain the fix.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
