GHSA-573f-x89g-hqp9

Suggest an improvement
Source
https://github.com/advisories/GHSA-573f-x89g-hqp9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-573f-x89g-hqp9/GHSA-573f-x89g-hqp9.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-573f-x89g-hqp9
Aliases
Published
2026-03-05T21:29:54Z
Modified
2026-05-06T12:44:52Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Details

Description

Fastify incorrectly accepts malformed Content-Type headers containing trailing characters after the subtype token, in violation of RFC 9110 ยง8.3.1. For example, a request sent with Content-Type: application/json garbage passes validation and is processed normally, rather than being rejected with 415 Unsupported Media Type.

When regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached.

Impact

An attacker can send requests with RFC-invalid Content-Type headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid.

Workarounds

Deploy a WAF rule to protect against this

Fix

The fix is available starting with v5.8.1.

Database specific 
{
    "cwe_ids":  [
        "CWE-185"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-05T21:29:54Z",
    "nvd_published_at":  "2026-03-06T18:16:22Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / fastify

Package

Name
fastify
View open source insights on deps.dev
Purl
pkg:npm/fastify

Affected ranges

Type
SEMVER
Events
Introduced
5.7.2
Fixed
5.8.1

Database specific

last_known_affected_version_range 
"<= 5.8.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-573f-x89g-hqp9/GHSA-573f-x89g-hqp9.json"