Fastify incorrectly validates `Content-Type` headers, accepting malformed headers with trailing characters after the subtype token, which violates RFC 9110. Specifically, a request with a `Content-Type` like 'application/json garbage' may be processed instead of being rejected with a 415 Unsupported Media Type error. When using regex-based content-type parsers, the malformed value is matched against registered parsers, potentially routing the request to an unintended parser. This allows an attacker to bypass content validation and have the server process requests with invalid content types.