Applications built with Fastify that rely on schema.body.content to validate request bodies are vulnerable because inserting a single leading space in the Content‑Type header causes the library to skip body validation entirely. The request body is still parsed, but the validation logic that would normally enforce the declared schema is bypassed, allowing attackers to send malformed or malicious data that could otherwise be rejected. This flaw stems from a regression introduced in Fastify versions starting at 5.3.2 and is tied to a previous advisory (CVE‑2025‑32442).

The vulnerability affects the Fastify framework (fastify:fastify) in any application using content‑type specific body validation. The regression is present in all releases from 5.3.2 through 5.8.4; versions 5.8.5 and later contain the fix.

The flaw carries a CVSS score of 7.5, indicating moderate‑to‑high severity. No EPSS score is available and the issue has not been listed in the CISA KEV catalog, suggesting that exploitation is not yet widespread. Attackers would need to send crafted HTTP requests with a header that includes a leading space, which is a straightforward capability for anyone capable of tampering with outbound traffic. Once bypassed, the payload can be used to inject unexpected data into the application, potentially leading to further downstream security issues depending on how the data is processed.