CVE-2022-39288: Fastify denial of service via malformed Content-Type header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 high severity with network-reachable, unauthenticated denial of service and very high EPSS probability, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

Fastify, a Node.js web framework, mishandles invalid Content-Type headers, allowing a crafted request to crash the application. The flaw is a denial of service that requires no authentication and is trivially reachable over the network. It was fixed in commit fbb07e8d and release 4.8.1.

Impact

An unauthenticated attacker can crash the Fastify process, causing service unavailability for all users of the affected application. There is no confidentiality or integrity impact; only availability is affected.

Attack surface

Reachable remotely over HTTP by sending a request with a malformed Content-Type header to any endpoint that parses content type. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.59244 (99th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Fastify to version 4.8.1 or later, which includes the fix in commit fbb07e8d.
• If upgrade is not possible, manually filter or reject HTTP requests with malformed Content-Type headers before they reach Fastify.
• Deploy a reverse proxy or WAF rule that validates Content-Type headers and blocks malformed values.
• Monitor Fastify process crashes and restart behavior to detect exploitation attempts.
• Track the GitHub security advisory GHSA-455w-c45v-86rg for updated guidance.

Detection

• Monitor application logs for process crashes or unhandled exceptions correlated with incoming requests containing unusual Content-Type values.
• Inspect HTTP access logs for requests with malformed or non-standard Content-Type headers, especially repeated attempts from the same source.
• Alert on Fastify service restarts or availability gaps that coincide with spikes in malformed header traffic.
• Use WAF or proxy logs to identify and block sources sending invalid Content-Type headers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.