GHSA-247c-9743-5963
High · 7.5CVSS
7.5
EPSS
—
Published
Apr 15, 2026
CISA due date
—
The record
Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | fastify | 5.3.2 | 5.8.5 |
Related vulnerabilities
- CVE-2026-33806 Impact: Fastify applications using schema.body.content for per-content-type body… Same vulnerability
- GHSA-444r-cwp2-x5xf fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from… Also affects fastify
- CVE-2026-3635 Summary When trustProxy is configured with a restrictive trust function (e.g., a specific… Also affects fastify
- CVE-2026-3419 Fastify incorrectly accepts malformed `Content-Type` headers containing trailing… Also affects fastify
- GHSA-573f-x89g-hqp9 Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass… Also affects fastify
- CVE-2026-25224 Fastify is a fast and low overhead web framework, for Node.js. Also affects fastify
- CVE-2026-25223 Fastify is a fast and low overhead web framework, for Node.js. Also affects fastify
- GHSA-mrq3-vjjr-p77c Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream Also affects fastify