CVE-2026-33806

OVERVIEW CVE-2026-33806 is a schema validation bypass vulnerability affecting Fastify web framework versions 5.3.2 and later. Applications using schema.body.content for per-content-type body validation are susceptible to complete validation circumvention when attackers prepend a space character to the Content-Type header. While the request body is still parsed correctly, the corresponding schema validation is entirely skipped, allowing malformed or malicious payloads to reach application logic. This represents a regression introduced by the patch for CVE-2025-32442. SEVERITY The vulnerability carries a CVSS score of 7.5 (High) with a network-based attack vector requiring no authentication or user interaction. Attack complexity is low, meaning exploitation is straightforward and reliable. The primary impact is integrity compromise, as attackers can bypass validation controls to inject or modify data. While no confidentiality or availability impact is indicated, the integrity violation could lead to data corruption, privilege escalation, or unauthorized state changes depending on how applications use validated data. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA KEV catalog, and community attention remains minimal based on inactive hot list status. No public exploit code has been disclosed. The EPSS score of 0.000980 indicates very low predicted exploitation probability. However, the straightforward nature of the attack (prepending a space character) means exploitation could be trivial to implement if discovered.