CVE-2026-107832fastify vulnerable to header validation bypass via case-sensitive propertyNames
Updated under an hour ago ()
Does this affect you?
It affects fastify. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.
- CVSS
- 3.7 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-178
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openjs
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 13, 2026
Affected products
fastify fastify fastify:fastify (from the name) | from 5.12.2 before 5.12.6; 5.12.6 not affected | CNA record |
References
- https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8
- https://cna.openjsf.org/security-advisories.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.