{"id":"CVE-2026-107832","aliases":["CLSA-2026-1792472724","CLSA-2026-1793791632","EUVD-2026-98697","GHSA-389g-gv7q-r4x8"],"status":"published","title":"fastify vulnerable to header validation bypass via case-sensitive propertyNames","description":"fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00257,"percentile":0.17534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-178"],"published":"2026-10-13T13:23:24Z","modified":"2026-11-04T14:45:06Z","fixes":[{"ecosystem":"npm","package":"fastify","fixed_in":["5.12.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.2"},{"fixed":"5.12.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.4-tuxcare.0"},{"fixed":"5.12.4-tuxcare.1"}]}],"versions":["5.12.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.5-tuxcare.0"},{"fixed":"5.12.5-tuxcare.1"}]}],"versions":["5.12.5"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"fastify","ranges":[{"type":"SEMVER","events":[{"introduced":"5.12.2"},{"fixed":"5.12.6"}]}]}],"products":[{"vendor":"@clerk","product":"fastify"},{"vendor":"fastify","product":"fastify"}],"references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8","tags":["advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107832","tags":["advisory"]},{"url":"https://github.com/fastify/fastify/pull/7104","tags":["web"]},{"url":"https://github.com/fastify/fastify/commit/3241fbd2f10a8ca1503533726836b53b6e8775a2","tags":["web"]},{"url":"https://github.com/fastify/fastify/commit/35c32375731c111439682b2f9e6e0baed2694269","tags":["web"]},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-389g-gv7q-r4x8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107832.json","tags":["advisory"]},{"url":"https://github.com/fastify/fastify","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-107832","title":"fastify vulnerable to header validation bypass via case-sensitive propertyNames","description":"fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.","status":"published","published":"2026-10-13T13:23:24.217Z","modified":"2026-10-15T19:14:58.255Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-98697","description":"fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.","status":"published","published":"2026-10-13T13:23:24Z","modified":"2026-10-15T19:14:58Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T17:00:10.766559Z"}],"ghsa":[{"id":"GHSA-389g-gv7q-r4x8","title":"fastify is vulnerable to header validation bypass via case-sensitive propertyNames","description":"### Impact\n\nFastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a `propertyNames` subschema's `enum` and `const`. A header-name deny-list written in the canonical header case, such as `propertyNames: { not: { enum: ['X-Debug-Override'] } }`, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a `propertyNames` deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the `not: { required: [...] }` form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 ([GHSA-9q9j-q6p8-xq58](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)), whose normalization covered header names used as property keys but not those used as values inside `propertyNames`.\n\n### Patches\n\nUsers should upgrade to fastify `5.12.6` or later, which lowercases header names held in `enum` and `const` inside a `propertyNames` subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (`propertyNames` `pattern` and `patternProperties` keys) and a `$ref` used inside `propertyNames`, are documented and, for the `$ref` case, warned at startup (`FSTSEC003`). Author those to match the lowercased request headers.\n\n### Workarounds\n\nWrite the `propertyNames` header-name constraint in lowercase (for example `enum: ['x-debug-override']`), or enforce the header check in an `onRequest` or `preValidation` hook instead of the schema.","status":"published","published":"2026-10-22T16:40:35Z","modified":"2026-10-22T16:40:37Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:41:34.690842Z"}],"nvd":[{"id":"CVE-2026-107832","description":"fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.","status":"published","published":"2026-10-13T14:17:19.167Z","modified":"2026-10-15T20:38:04.303Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:12:56.72789Z"}],"osv":[{"id":"CVE-2026-107832","title":"fastify vulnerable to header validation bypass via case-sensitive propertyNames","description":"fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.","status":"published","published":"2026-10-13T13:23:24.217Z","modified":"2026-10-28T02:31:12.676396687Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"GHSA-389g-gv7q-r4x8","title":"fastify is vulnerable to header validation bypass via case-sensitive propertyNames","description":"### Impact\n\nFastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a `propertyNames` subschema's `enum` and `const`. A header-name deny-list written in the canonical header case, such as `propertyNames: { not: { enum: ['X-Debug-Override'] } }`, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a `propertyNames` deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the `not: { required: [...] }` form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 ([GHSA-9q9j-q6p8-xq58](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)), whose normalization covered header names used as property keys but not those used as values inside `propertyNames`.\n\n### Patches\n\nUsers should upgrade to fastify `5.12.6` or later, which lowercases header names held in `enum` and `const` inside a `propertyNames` subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (`propertyNames` `pattern` and `patternProperties` keys) and a `$ref` used inside `propertyNames`, are documented and, for the `$ref` case, warned at startup (`FSTSEC003`). Author those to match the lowercased request headers.\n\n### Workarounds\n\nWrite the `propertyNames` header-name constraint in lowercase (for example `enum: ['x-debug-override']`), or enforce the header check in an `onRequest` or `preValidation` hook instead of the schema.","status":"published","published":"2026-10-22T16:40:35Z","modified":"2026-10-22T16:45:04.287484964Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"CLSA-2026-1792472724","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.4-tuxcare.1.","status":"published","published":"2026-10-20T05:05:24Z","modified":"2026-10-20T07:15:03.82037457Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793791632","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.5-tuxcare.1.","status":"published","published":"2026-11-04T12:27:13Z","modified":"2026-11-04T14:45:06.150121554Z","updated_at":"2026-11-04T15:03:54.132276Z"}]}}