PT-2026-23622 · Fastify · Fastify

James Sumners + 3 · Published 2026-03-05 · Updated 2026-03-13 · CVE-2026-3419

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fastify versions prior to 5.8.1

Description Fastify incorrectly validates Content-Type headers, accepting malformed headers with trailing characters after the subtype token, which violates RFC 9110. Specifically, a request with a Content-Type like 'application/json garbage' may be processed instead of being rejected with a 415 Unsupported Media Type error. When using regex-based content-type parsers, the malformed value is matched against registered parsers, potentially routing the request to an unintended parser. This allows an attacker to bypass content validation and have the server process requests with invalid content types.

Recommendations Versions prior to 5.8.1 should be updated to version 5.8.1 or later. As a temporary workaround, deploy a WAF rule to protect against this issue.

Fix

Weakness Enumeration

CWE-185

Related Identifiers

CVE-2026-3419

GHSA-573F-X89G-HQP9

Affected Products

Fastify

References · 14

• https://github.com/fastify/fastify/security/advisories/GHSA-573f-x89g-hqp9 · Vendor Advisory
• https://github.com/fastify/fastify/commit/67f6c9b32cb3623d3c9470cc17ed830dd2f083d7 · Patch
• https://cna.openjsf.org/security-advisories.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3419 · Security Note
• https://osv.dev/vulnerability/GHSA-573f-x89g-hqp9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3419 · Security Note
• https://github.com/advisories/GHSA-573f-x89g-hqp9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3419 · Vendor Advisory
• https://github.com/fastify/fastify · Note
• https://twitter.com/SaadFellahii/status/2032469562831097998 · Twitter Post
• https://httpwg.org/specs/rfc9110.html#field.content-type · Note
• https://reddit.com/r/VulnMatter/comments/1rmd0qe/resumen_diario_de_vulnerabilidades_06032026 · Reddit Post
• https://twitter.com/kom_256/status/2029974159334297850 · Twitter Post
• https://t.me/CVEtracker/46639 · Telegram Post