Fastify Malformed Content-Type Header Vulnerability - Fastify

CVE-2026-3419

What is CVE-2026-3419?

Fastify has a vulnerability where it incorrectly processes malformed Content-Type headers with trailing characters, violating RFC standards. This flaw allows attackers to send requests containing invalid Content-Type headers that bypass intended validity checks. Consequently, such requests can reach content-type parsers, which may incorrectly treat them as valid, potentially leading to unintended processing by the server. Users are advised to implement web application firewall (WAF) rules as a protective measure and update to Fastify version 5.8.1 or later to mitigate this issue.

References