GHSA-573f-x89g-hqp9 CVE-2026-3419
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.36%
- Chance of exploitation in the next 30 days. Higher than 30.41% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-185 Incorrect Regular Expression
- Fix
5.8.1- Upgrade fastify to this version or later
Description
Description
Fastify incorrectly accepts malformed Content-Type headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1. For example, a request sent with Content-Type: application/json garbage passes validation and is processed normally, rather than being rejected with 415 Unsupported Media Type.
When regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached.
Impact
An attacker can send requests with RFC-invalid Content-Type headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid.
Workarounds
Deploy a WAF rule to protect against this
Fix
The fix is available starting with v5.8.1.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| fastify | >= 5.7.2, < 5.8.1 |
5.8.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
fastify npm → 5.8.1
- npm
npm install fastify@5.8.1- yarn
yarn add fastify@5.8.1- pnpm
pnpm add fastify@5.8.1
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-185: Incorrect Regular Expression
The product specifies a regular expression in a way that causes data to be improperly matched or compared.
How to prevent it
- Implementation: Regular expressions can become error prone when defining a complex language even for those experienced in writing grammars. Determine if several smaller regular expressions simplify one large regular expression. Also, subject the regular expression to thorough testing techniques such as equivalence partitioning, boundary value analysis, and robustness. After testing and a reasonable confidence level is achieved, a regular expression may not be foolproof. If an exploit is allowed to slip through, then record the exploit and refactor the regular expression.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-389g-gv7q-r4x8 fastify is vulnerable to header validation bypass via case-sensitive propertyNames | Low | Also affects fastify |
| GHSA-4mh8-r7rc-xpvc fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses | Medium | Also affects fastify |
| GHSA-9q9j-q6p8-xq58 fastify vulnerable to header validation bypass via incomplete schema case normalization | High | Also affects fastify |
| GHSA-667r-xxjv-c9mm fastify vulnerable to request body replacement via an async validation result collision | High | Also affects fastify |
| GHSA-hwr6-493r-vm6h fastify vulnerable to request validation bypass via skipped boolean false schemas | High | Also affects fastify |
| GHSA-p68q-wchp-6fh7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers | High | Also affects fastify |
| GHSA-w2qp-rph6-63g4 fastify vulnerable to schema validation bypass via root primitive coercion mismatch | Medium | Also affects fastify |
| GHSA-3m5p-2c4r-xxw2 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count | Medium | Also affects fastify |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor