CVE-2026-3419 Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Attackers can bypass Content-Type validation in Fastify by sending malformed headers, potentially routing requests to unintended parsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3419?
CVE-2026-3419 is a medium-severity vulnerability in fastify, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://httpwg.org/specs/rfc9110.html#field.content-type). For example, a request sent with Content-Type: application/json garbage passes validation and is processed normally, rather than being rejected with 415 Unsupported Media Type.
When regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached.
Impact: An attacker can send requests with RFC-invalid Content-Type headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid.
Workarounds: Deploy a WAF rule to protect against this
Fix:
The fix is available starting with v5.8.1.
Weakness: CWE-185
Which versions are affected by CVE-2026-3419?
2 open source packages ship an affected version, including fastify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fastify npm | From 5.7.2 | 5.8.1 |
fastify npm | From 5.7.2 | 5.8.1 |
Products include Fastify Fastify.
How do I fix CVE-2026-3419?
Upgrade fastify to 5.8.1 or later.
Is CVE-2026-3419 being exploited?
There is no known exploitation of CVE-2026-3419 in the wild and no public exploit code.
Other vulnerabilities in fastify
- CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision
- CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas
- CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
Sources
Also known as GHSA-573f-x89g-hqp9.