GHSA-573f-x89g-hqp9
Medium · 5.3CVSS
5.3
EPSS
—
Published
Mar 5, 2026
CISA due date
—
The record
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | fastify | 5.7.2 | 5.8.1 |
Related vulnerabilities
- CVE-2026-3419 Fastify incorrectly accepts malformed `Content-Type` headers containing trailing… Same vulnerability
- GHSA-247c-9743-5963 Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header Also affects fastify
- CVE-2026-33806 Impact: Fastify applications using schema.body.content for per-content-type body… Also affects fastify
- GHSA-444r-cwp2-x5xf fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from… Also affects fastify
- CVE-2026-3635 Summary When trustProxy is configured with a restrictive trust function (e.g., a specific… Also affects fastify
- CVE-2026-25224 Fastify is a fast and low overhead web framework, for Node.js. Also affects fastify
- CVE-2026-25223 Fastify is a fast and low overhead web framework, for Node.js. Also affects fastify
- GHSA-mrq3-vjjr-p77c Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream Also affects fastify