CVE-2026-3419: Fastify malformed Content-Type header validation bypass

CVE-2026-3419 · Severity: low · CVSS 3.1 · Published 2026-03-05

Fastify, a popular Node.js web framework, incorrectly accepts malformed Content-Type headers that violate HTTP standards. An attacker can send requests with invalid Content-Type headers (e.g., "application/json garbage") that bypass validation checks and reach content-type parsers they should be rejected by, potentially causing requests to be processed by unintended handlers. This could lead to security issues depending on how the application's request routing and parsing logic handles mismatched content types.

Technologies: fastify (npm). Vendors: npm.

Quick answers

Is CVE-2026-3419 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3419 being exploited in the wild.
How severe is CVE-2026-3419?
Low severity, with a CVSS score of 3.1, published 5 March 2026.
Which products and versions are affected?
fastify (npm) SEMVER:introduced=5.7.2,fixed=5.8.1.
Is there a fix for CVE-2026-3419?
Yes. fastify (npm): upgrade to 5.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3419 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-3419?
Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fastify (npm): upgrade to 5.8.1 or later
    npm install fastify@5.8.1

Technical details

The vulnerability is an incorrect regular expression (CWE-185) in Fastify's "subtypeNameReg" regex pattern used to validate Content-Type headers. The regex lacks an end anchor ($), allowing malformed Content-Type headers with trailing characters after the subtype token to pass validation. For example, "application/json garbage" is accepted instead of being rejected with HTTP 415 Unsupported Media Type. When regex-based content-type parsers are configured (a documented Fastify feature), the full malformed string—including trailing garbage—is matched against registered parsers. This can cause a request to be routed to and processed by a parser it should never have reached, violating RFC 9110 §8.3.1. The vulnerability affects Fastify versions >= 5.7.2 and <= 5.8.0; it was fixed in version 5.8.1. No authentication or user interaction is required; the attack is network-accessible.

Affected products

  • Fastify fastify >= 5.7.2, <= 5.8.0

Identifiers

  • CVE-2026-3419
  • GHSA-573f-x89g-hqp9

Timeline

  • 2026-03-05: disclosed: GHSA-573f-x89g-hqp9 published
  • 2026-03-05: patched: Fix available in v5.8.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.