CVE-2026-3419: Fastify's Content-Type Validation Flaw Allows Malformed Headers
Summary
CVE-2026-3419: Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation. Affects fastify versions >= 5.7.2, < 5.8.1. Fixed in 5.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js that is designed to be highly efficient and lightweight, enabling developers to build web applications and APIs quickly. It supports a variety of features, including schema-based validation, routing, and plugins. However, it has a vulnerability that allows malformed Content-Type headers to bypass validation, potentially leading to improper request handling.
Vulnerability Detail
Fastify incorrectly validates Content-Type headers, allowing malformed headers with trailing characters to pass through. This violates RFC 9110 §8.3.1, which specifies the correct format for Content-Type headers. As a result, an attacker can send requests with invalid Content-Type headers that are processed by the server, potentially leading to unexpected behavior or security issues. The vulnerability arises from regex-based content-type parsers that match the entire string, including any invalid trailing characters.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.8.1
This is the first release that contains the fix.
npm install fastify@5.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can deploy a Web Application Firewall (WAF) rule to filter out requests with malformed Content-Type headers. This can help mitigate the risk until you are able to update the Fastify package.
Conclusion
In summary, Fastify has a vulnerability (CVE-2026-3419) that allows malformed Content-Type headers to bypass validation, which could lead to improper request handling. It is crucial to update to version 5.8.1 or later to mitigate this risk. Additionally, deploying a WAF rule can serve as a temporary workaround.
See every vulnerability recorded for fastify →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include improper request handling, which could lead to security issues or unexpected behavior in your application.
Yes, Fastify versions 5.7.2 to 5.8.0 are vulnerable to this issue. Updating to version 5.8.1 or later resolves the vulnerability.
A Web Application Firewall (WAF) is a security tool that monitors and filters HTTP traffic to and from a web application, helping to protect against various types of attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
