Fastify CVE-2026-33806

Fastify is a high-performance Node.js web framework supporting JSON Schema-based request validation. The vulnerability targets applications using the schema.body.content configuration for content-type-specific body validation, where different schemas can be applied based on Content-Type headers (e.g., application/json vs multipart/form-data). The CWE-1287 classification indicates improper validation of specified type of input, specifically a header parsing inconsistency. The framework's Content-Type matching logic fails when the header value contains leading whitespace, causing a mismatch between the parsing layer (which correctly handles ' application/json') and the validation layer (which expects 'application/json'). This creates a parsing differential where the body is processed according to the content type but validation is entirely skipped, violating the principle of defense in depth in input validation pipelines.