fastify 存在通过 Content-Type 头中的前导空格绕过 Body Schema 验证漏洞

The impact of this vulnerability lies in the circumvention of request body validation. Applications relying on Fastify's schema validation to enforce data integrity and security policies are now vulnerable. An attacker could potentially inject malicious data into requests that would normally be rejected by the validation process. This could lead to various consequences, including unauthorized access, data modification, or even remote code execution, depending on how the application handles the unvalidated data. The bypass is subtle, requiring only a single space character, making it easy to exploit. This vulnerability is similar in concept to other bypasses that exploit parsing quirks in web frameworks.

Applications built using Fastify versions 5.3.2 through 5.8.4 are at risk, particularly those that heavily rely on request body schema validation for security or data integrity. This includes APIs and web services that process user-supplied data and enforce validation rules.

• nodejs / server:

  ps aux | grep -i fastify
  # Check for versions below 5.8.5
  npm list fastify

• generic web:

  curl -I <your_fastify_endpoint> | grep Content-Type
  # Look for Content-Type headers with leading spaces

1. 2026-04-15Disclosure

   disclosure

1. 已保留2026-03-23
2. 发布日期2026-04-15
3. 修改日期2026-04-24
4. EPSS 更新日期2026-04-22

The primary mitigation for CVE-2026-33806 is to upgrade to Fastify version 5.8.5 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a temporary workaround by explicitly stripping leading whitespace from the Content-Type header before passing the request to Fastify. This can be achieved in your application code or potentially through a reverse proxy. Additionally, carefully review your request body validation schemas to ensure they are robust and handle unexpected input. After upgrading, confirm the fix by sending a request with a Content-Type header prepended with a space and verifying that the schema validation is correctly enforced.