p PatchFirst

CVE-2026-3419

CVE-2026-3419 · Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://httpwg.org/specs/rfc9110.html#field.content-type). For example, a request sent with Content-Type: application/json garbage passes validation and is processed normally, rather than being rejected with 415 Unsupported Media Type. When regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached. Impact: An attacker can send requests with RFC-invalid Content-Type headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid. Workarounds: Deploy a WAF rule to protect against this Fix: The fix is available starting with v5.8.1.

CVSS 5.3 · Mittel · EPSS 0,4% · Korrektur verfügbar

Veröffentlicht
Aktualisiert

Technologie-Stack: node

Betroffene Produkte und Versionen

  • fastify

    Softwareversionen
    • ≥ 5.7.2, < 5.8.1: Betroffen (semver)
    • 5.8.1: Nicht betroffen (semver)

    Auf 5.8.1 aktualisieren

  • fastify npm

    Betroffene Versionsbereiche
    • SEMVER: ≥ 5.7.2, < 5.8.1

    Auf 5.8.1 aktualisieren

Originalquellen

Prüfen Sie Ihren Server →