Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://httpwg.org/specs/rfc9110.html#field.content-type). For example, a request sent with Content-Type: application/json garbage passes validation and is processed normally, rather than being rejected with 415 Unsupported Media Type. When regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached. Impact: An attacker can send requests with RFC-invalid Content-Type headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid. Workarounds: Deploy a WAF rule to protect against this Fix: The fix is available starting with v5.8.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fastify | fastify | 5.7.2 to before 5.8.1 | 5.8.1 | Patch available | CNA |
| — | fastify (npm) | 5.7.2 to before 5.8.1 | 5.8.1 | Patch available | GHSA-573f-x89g-hqp9 |
- fastify Vendorfastify Affected 5.7.2 to before 5.8.1 Fixed in 5.8.1 Patch available CNA
- fastify (npm) Vendor— Affected 5.7.2 to before 5.8.1 Fixed in 5.8.1 Patch available GHSA-573f-x89g-hqp9
Remediation
- Fix · CNA fastify (fastify) Fixed in 5.8.1
- Fix · GHSA-573f-x89g-hqp9 fastify (npm) Fixed in 5.8.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3419
- 2026-10-03 Alias added: GHSA-573f-x89g-hqp9
References
Patch 2
Advisory 3
More Fastify vulnerabilities
- TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
- TI-2025-23513 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass CVSS 3.1HIGH 7.5
- TI-2026-58050 fastify vulnerable to request validation bypass via skipped boolean false schemas CVSS 3.1HIGH 7.5
- TI-2026-58022 fastify vulnerable to header validation bypass via incomplete schema case normalization CVSS 3.1HIGH 7.5
- TI-2026-53284 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVSS 3.1HIGH 7.5
- TI-2026-26178 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header CVSS 3.1HIGH 7.5
Sources
- CVE-2026-3419 · CVE Program
- CVE-2026-3419 · NVD
- FIRST EPSS
- GHSA-573f-x89g-hqp9 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-3419 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences