25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass

A newly disclosed Fastify vulnerability (CVE-2026-33806, CVSS 7.5) allows an attacker to bypass request schema validation by prepending a single space to the Content-Type header (e.g., ' application/json'), causing the validator to skip checks; a public PoC and an urgent patch (upgrade to v5.8.5; add trimStart() in getEssenceMediaType) are provided.