{"id":"GHSA-573f-x89g-hqp9","summary":"Fastify's Missing End Anchor in \"subtypeNameReg\" Allows Malformed Content-Types to Pass Validation","details":"# Description\n\nFastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of [RFC 9110 §8.3.1](https://httpwg.org/specs/rfc9110.html#field.content-type). For example, a request sent with `Content-Type: application/json garbage` passes validation and is processed normally, rather than being rejected with `415 Unsupported Media Type`.\n\nWhen regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached.\n\n## Impact\n\nAn attacker can send requests with RFC-invalid `Content-Type` headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid.\n\n## Workarounds\n\nDeploy a WAF rule to protect against this\n\n## Fix\n\nThe fix is available starting with v5.8.1.","aliases":["CVE-2026-3419"],"modified":"2026-05-06T12:44:52.928404954Z","published":"2026-03-05T21:29:54Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-03-05T21:29:54Z","nvd_published_at":"2026-03-06T18:16:22Z","cwe_ids":["CWE-185"]},"references":[{"type":"WEB","url":"https://github.com/fastify/fastify/security/advisories/GHSA-573f-x89g-hqp9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3419"},{"type":"WEB","url":"https://github.com/fastify/fastify/commit/67f6c9b32cb3623d3c9470cc17ed830dd2f083d7"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-573f-x89g-hqp9"},{"type":"PACKAGE","url":"https://github.com/fastify/fastify"},{"type":"WEB","url":"https://httpwg.org/specs/rfc9110.html#field.content-type"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-3419"}],"affected":[{"package":{"name":"fastify","ecosystem":"npm","purl":"pkg:npm/fastify"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.7.2"},{"fixed":"5.8.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 5.8.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-573f-x89g-hqp9/GHSA-573f-x89g-hqp9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}