CVE-2026-3419

Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://httpwg.org/specs/rfc9110.html#field.content-type). For example, a request sent with Content-Type: application/json garbage passes validation and is processed normally, rather than being rejected with 415 Unsupported Media Type. When regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached. Impact: An attacker can send requests with RFC-invalid Content-Type headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid. Workarounds: Deploy a WAF rule to protect against this Fix: The fix is available starting with v5.8.1.

• CWE-185

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/advisories/GHSA-573f-x89g-hqp9Patch, Vendor Advisory
• https://github.com/fastify/fastify/commit/67f6c9b32cb3623d3c9470cc17ed830dd2f083d7Patch
• https://github.com/fastify/fastify/security/advisories/GHSA-573f-x89g-hqp9Vendor Advisory
• https://httpwg.org/specs/rfc9110.html#field.content-typeTechnical Description
• https://www.cve.org/CVERecord?id=CVE-2026-3419VDB Entry

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34183Issue summary: Remote peer may exhaust heap memory of the QU…7.5
• CVE-2026-34184Hydrosystem Control System does not enforce authorization fo…9.1
• CVE-2026-34185Hydrosystem Control System is vulnerable to SQL Injection ac…8.8
• CVE-2026-34186Improper Neutralization of Special Elements used in an SQL C…8.8
• CVE-2026-34187Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2026-34188Improper Neutralization of Special Elements used in an OS Co…7.2
• CVE-2026-34191Improper Neutralization of Special Elements used in an SQL C…9.1
• CVE-2026-34192Software installed and run as a non-privileged user may cond…7.7
• CVE-2026-34193Kernel software installed and running inside a Guest/Host VM…4.3
• CVE-2026-34194Software installed and run as a non-privileged user may cond…7.1
• CVE-2026-34195Software installed and run as a non-privileged user may cond…8.8
• CVE-2026-34196Software installed and run as a non-privileged user may cond…7.8