Summary

• Add a new non-vulnerability example to SECURITY.md explaining that content-type parser/schema mismatches (regex parser accepts a content type with no matching schema.body.content key) are an application configuration concern, not a framework vulnerability
• Add a warning to docs/Reference/Validation-and-Serialization.md explaining that the content map uses exact MIME type matching and how this interacts with regex-based parsers
• Add a note to docs/Reference/ContentTypeParser.md warning that regex parsers can accept content types that bypass per-content-type validation if the schema content map lacks a matching entry

Context

This addresses reports like the one described in the bug report where a regex-based content-type parser (e.g., /^application\/.*json$/) matches requests with content types like application/v1+json, but the validation schema only has a key for application/json. The parser runs correctly but validation is skipped because the schema lookup is an exact string match. This is by design — schemas and configuration are trusted inputs in Fastify's threat model.

Test plan

• npm run lint:markdown passes (no new lint errors)
• Documentation-only change, no code changes

🤖 Generated with Claude Code