npm/fastify CVE-2025-32442, CVE-2026-33806: high 7.5, EPSS 0.73%
Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header
Action: Upgrade fastify to 5.8.5 or later.
npm i fastify@5.8.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.3.2 | 5.8.5 | - |
Fixed versions
| 5.8.5 |
Sources
- osv: GHSA-247c-9743-5963
- https://github.com/fastify/fastify/security/advisories/GHSA-247c-9743-5963
- https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc
- https://nvd.nist.gov/vuln/detail/CVE-2025-32442
- https://nvd.nist.gov/vuln/detail/CVE-2026-33806
- https://github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify
- https://github.com/fastify/fastify/releases/tag/v5.8.5
CVE-2025-32442, CVE-2026-33806 · published · modified · JSON