CVE-2026-3419: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3419 is a Content-Type validation bypass vulnerability in the Fastify Node.js web framework, formally titled "Missing End Anchor in 'subtypeNameReg' Allows Malformed Content-Types to Pass Validation." It affects Fastify versions >= 5.7.2 and <= 5.8.0 (npm package). The vulnerability was published on March 5, 2026, via a GitHub Security Advisory, and added to the NVD on March 6, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a missing end anchor ($) in the subtypeNameReg regular expression defined in lib/content-type.js, classified as CWE-185 (Incorrect Regular Expression) and CWE-625 (Permissive Regular Expression). The original regex /^[\w!#$%&'*+.^\|~-]+\s*/matched only the leading portion of the subtype string rather than the entire string, allowing trailing garbage characters (e.g.,application/json garbageorapplication/json@evil) to pass validation. The fix, applied in commit 67f6c9b, changes the regex to /^[\w!#$%&'+.^`|~-]+\s$/`, enforcing a full-string match per RFC 9110 §8.3.1. When regex-based content-type parsers are configured (a documented Fastify feature), the malformed value — including its trailing garbage — is matched against registered parsers, potentially routing the request to an unintended parser (GitHub Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to send RFC-invalid Content-Type headers that bypass Fastify's validation stage and are processed as if valid. The primary impact is an integrity violation: requests that should be rejected with 415 Unsupported Media Type are instead routed to and handled by content-type parsers they should never reach, potentially circumventing content-type-based security controls or triggering unintended application logic. Confidentiality and availability are not directly impacted per the CVSS assessment, but the bypass could serve as a stepping stone for further exploitation depending on application-specific parser behavior (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity, making it straightforward to attempt. The EPSS score is approximately 0.034% (0.000340), placing it in the 4th percentile for exploitation likelihood within 30 days. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify target: Locate a Fastify-based application running npm package version >= 5.7.2 and <= 5.8.0, particularly one using regex-based custom content-type parsers.
2. Craft malformed Content-Type header: Construct an HTTP request with a Content-Type header containing trailing garbage after the subtype token, such as Content-Type: application/json garbage or Content-Type: application/json@evil.
3. Send the request: Transmit the crafted request to any endpoint on the vulnerable Fastify server that performs content-type validation (e.g., a POST endpoint expecting application/json).
4. Bypass validation: Because subtypeNameReg lacks a terminal anchor, Fastify's parser accepts the malformed header as valid instead of returning 415 Unsupported Media Type.
5. Reach unintended parser: If regex-based content-type parsers are registered, the full malformed string (including trailing garbage) is matched against them, potentially routing the request to a parser it should not reach and triggering unintended application behavior (GitHub Advisory, GitHub Commit).

• Network: HTTP requests to Fastify endpoints containing Content-Type headers with trailing non-standard characters after the subtype token (e.g., application/json garbage, application/json@evil, application/json\x00garbage, application/json(garbage)).
• Logs: Application or access logs showing requests with malformed Content-Type values that were processed successfully (HTTP 200) rather than rejected with HTTP 415; look for unusual subtype strings containing spaces, special characters, or extra tokens after the media subtype.
• Application Behavior: Unexpected invocation of custom regex-based content-type parsers for request types they were not intended to handle, potentially visible in application-level debug or error logs.

Upgrade Fastify to version 5.8.1 or later, which corrects the subtypeNameReg regex by adding a terminal anchor ($) to enforce full-string matching per RFC 9110 §8.3.1. As a temporary workaround for environments that cannot immediately upgrade, deploy a Web Application Firewall (WAF) rule to reject HTTP requests containing malformed Content-Type headers with trailing characters after the subtype token. Additionally, review any custom regex-based content-type parsers to ensure they only match properly formatted values (GitHub Advisory, GitHub Commit).

The advisory was published by Fastify maintainer mcollina on March 5, 2026, with jsumners as the remediation developer and UlisesGascon as the remediation reviewer; the vulnerability was originally reported by TarPeg007. Red Hat tracked the issue via Bugzilla (Bug 2445295) and classified it as medium severity. IBM also issued advisories noting the impact on IBM API Connect products. Community discussion was limited, with automated CVE tracking bots on Bluesky and aggregator sites (VulnDB, CVEFeed) picking up the disclosure shortly after publication (GitHub Advisory, Red Hat Bugzilla).