CVE-2026-107832
3.7LowPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-178
Impact
Remote unauthenticated attackers can bypass route header validation schemas and pass forbidden or restricted headers into request handlers. This occurs when applications rely on propertyNames schemas with mixed-case header lists.
Root cause
The schema normalization routine fails to lowercase header names configured inside enum or const fields under propertyNames subschemas.
Affected systems
fastify 5.12.2 through 5.12.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
Upgrade fastify to version 5.12.6 or later. If upgrading must wait, manually update all route schemas to define propertyNames header names in all lowercase.
$ npm install fastify@^5.12.6AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.