CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://httpwg.org/specs/rfc9110.html#field.content-type). For example, a request sent with Content-Type: application/json garbage passes validation and is processed normally, rather than being rejected with 415 Unsupported Media Type. When regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached. Impact: An attacker can send requests with RFC-invalid Content-Type headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid. Workarounds: Deploy a WAF rule to protect against this Fix: The fix is available starting with v5.8.1.
Засегнати продукти
- fastify fastify: 5.7.2 преди 5.8.1; 5.8.1
Вид слабост
История
- 6 март 2026 Публикувано
Други уязвимости в fastify fastify
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-3419
- https://nvd.nist.gov/vuln/detail/CVE-2026-3419
- https://github.com/fastify/fastify/security/advisories/GHSA-573f-x89g-hqp9
- https://github.com/fastify/fastify/commit/67f6c9b32cb3623d3c9470cc17ed830dd2f083d7
- https://httpwg.org/specs/rfc9110.html#field.content-type
- https://github.com/advisories/GHSA-573f-x89g-hqp9
- https://cna.openjsf.org/security-advisories.html
- https://www.cve.org/CVERecord?id=CVE-2026-3419