{"id":"CVE-2026-84428","aliases":["CLSA-2026-1791629281","CLSA-2026-1791634874","CLSA-2026-1791806519","CLSA-2026-1791806950","CLSA-2026-1791839080","CLSA-2026-1792233089","CLSA-2026-1792242589","CLSA-2026-1794060794","EUVD-2026-70998","GHSA-9q9j-q6p8-xq58"],"status":"published","title":"fastify vulnerable to header validation bypass via incomplete schema case normalization","description":"fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00524,"percentile":0.4493,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-178"],"published":"2026-09-04T10:24:27Z","modified":"2026-11-07T19:00:36Z","fixes":[{"ecosystem":"npm","package":"fastify","fixed_in":["5.12.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fastify","fixed_in":["5.12.0-tuxcare.4","5.12.1-tuxcare.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.29.5-tuxcare.0"},{"fixed":"3.29.5-tuxcare.7"}]}],"versions":["3.29.5","3.29.5-tuxcare.1","3.29.5-tuxcare.2","3.29.5-tuxcare.3","3.29.5-tuxcare.4","3.29.5-tuxcare.5","3.29.5-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.0-tuxcare.0"},{"fixed":"5.12.0-tuxcare.4"}]}],"versions":["5.12.0","5.12.0-tuxcare.1","5.12.0-tuxcare.2","5.12.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.4-tuxcare.0"},{"fixed":"5.7.4-tuxcare.5"}]}],"versions":["5.7.4","5.7.4-tuxcare.1","5.7.4-tuxcare.2","5.7.4-tuxcare.3","5.7.4-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-tuxcare.0"},{"fixed":"5.2.1-tuxcare.5"}]}],"versions":["5.2.1","5.2.1-tuxcare.1","5.2.1-tuxcare.2","5.2.1-tuxcare.3","5.2.1-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.3-tuxcare.0"},{"fixed":"5.11.3-tuxcare.6"}]}],"versions":["5.11.3","5.11.3-tuxcare.1","5.11.3-tuxcare.2","5.11.3-tuxcare.3","5.11.3-tuxcare.4","5.11.3-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.29.1-tuxcare.0"},{"fixed":"4.29.1-tuxcare.7"}]}],"versions":["4.29.1","4.29.1-tuxcare.1","4.29.1-tuxcare.2","4.29.1-tuxcare.3","4.29.1-tuxcare.4","4.29.1-tuxcare.5","4.29.1-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.1-tuxcare.0"},{"fixed":"5.12.1-tuxcare.5"}]}],"versions":["5.12.1","5.12.1-tuxcare.1","5.12.1-tuxcare.2","5.12.1-tuxcare.3","5.12.1-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.1-tuxcare.0"},{"fixed":"4.28.1-tuxcare.1"}]}],"versions":["4.28.1"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"fastify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.12.2"}]}]}],"products":[{"vendor":"@clerk","product":"fastify"},{"vendor":"fastify","product":"fastify"}],"references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58","tags":["Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84428","tags":["advisory"]},{"url":"https://github.com/fastify/fastify/commit/179619c8e99d54924309b9933402151ef9af37e0","tags":["web"]},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9q9j-q6p8-xq58"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84428.json","tags":["advisory"]},{"url":"https://github.com/fastify/fastify","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-84428","title":"fastify vulnerable to header validation bypass via incomplete schema case normalization","description":"fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T10:24:27.809Z","modified":"2026-09-04T16:06:04.123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-70998","description":"fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T10:24:27Z","modified":"2026-09-04T16:06:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:12.302717Z"}],"ghsa":[{"id":"GHSA-9q9j-q6p8-xq58","title":"fastify vulnerable to header validation bypass via incomplete schema case normalization","description":"### Impact\n\nFastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level `properties` keys and the root `required` array, and did not lowercase the JSON Schema Draft 7 `dependencies` keyword (its trigger keys and dependent property names) or names in nested subschemas. As a result, a header schema that uses `dependencies` to require one header when another is present (for example `X-Admin` requiring `X-Admin-Token`) never matches the lowercased request headers, so the dependency assertion is silently skipped. An unauthenticated remote client can send the header that activates a privileged path while omitting the header the dependency was meant to require, bypassing a schema-enforced security control. The header schema is idiomatic, valid JSON Schema Draft 7, and no custom validator, malformed request, or misconfiguration is required.\n\n### Patches\n\nHeader-schema names are now normalized across all schema positions (`properties`, `required`, `dependencies`, `dependentRequired`, `dependentSchemas`, and nested subschemas). Patched in fastify `5.12.2`. The fix is also included in the `6.0.0` release. Header schemas referenced through an external shared `$ref` (registered with `addSchema`) are not reached by this normalization and now emit an `FSTSEC002` startup warning; inline the header schema to keep case-insensitive assertions in effect.\n\n### Workarounds\n\nIf upgrading is not immediately possible, write header-schema names in lowercase so the `dependencies` and other case-sensitive assertions match Node's lowercased request headers, or enforce the cross-header requirement in an `onRequest` or `preValidation` hook instead of the schema.","status":"published","published":"2026-09-30T23:44:27Z","modified":"2026-09-30T23:44:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-84428","description":"fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T11:17:19.317Z","modified":"2026-09-15T19:54:32.42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:12:43.737972Z"}],"osv":[{"id":"CVE-2026-84428","title":"fastify vulnerable to header validation bypass via incomplete schema case normalization","description":"fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T10:24:27.809Z","modified":"2026-10-28T02:30:34.253266535Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"GHSA-9q9j-q6p8-xq58","title":"fastify vulnerable to header validation bypass via incomplete schema case normalization","description":"### Impact\n\nFastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level `properties` keys and the root `required` array, and did not lowercase the JSON Schema Draft 7 `dependencies` keyword (its trigger keys and dependent property names) or names in nested subschemas. As a result, a header schema that uses `dependencies` to require one header when another is present (for example `X-Admin` requiring `X-Admin-Token`) never matches the lowercased request headers, so the dependency assertion is silently skipped. An unauthenticated remote client can send the header that activates a privileged path while omitting the header the dependency was meant to require, bypassing a schema-enforced security control. The header schema is idiomatic, valid JSON Schema Draft 7, and no custom validator, malformed request, or misconfiguration is required.\n\n### Patches\n\nHeader-schema names are now normalized across all schema positions (`properties`, `required`, `dependencies`, `dependentRequired`, `dependentSchemas`, and nested subschemas). Patched in fastify `5.12.2`. The fix is also included in the `6.0.0` release. Header schemas referenced through an external shared `$ref` (registered with `addSchema`) are not reached by this normalization and now emit an `FSTSEC002` startup warning; inline the header schema to keep case-insensitive assertions in effect.\n\n### Workarounds\n\nIf upgrading is not immediately possible, write header-schema names in lowercase so the `dependencies` and other case-sensitive assertions match Node's lowercased request headers, or enforce the cross-header requirement in an `onRequest` or `preValidation` hook instead of the schema.","status":"published","published":"2026-09-30T23:44:27Z","modified":"2026-10-01T00:00:05.759936763Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"CLSA-2026-1791629281","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 3.29.5-tuxcare.7.","status":"published","published":"2026-10-10T10:48:01Z","modified":"2026-10-15T09:47:59.791422398Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791634874","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.0-tuxcare.4.","status":"published","published":"2026-10-10T12:21:14Z","modified":"2026-10-15T09:48:00.155686394Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806519","title":"TuxCare security update for fastify (3 CVEs)","description":"TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.7.4-tuxcare.5.","status":"published","published":"2026-10-12T12:01:59Z","modified":"2026-10-15T09:47:40.246927962Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806950","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.2.1-tuxcare.5.","status":"published","published":"2026-10-12T12:09:10Z","modified":"2026-10-15T09:47:40.357309285Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791839080","title":"TuxCare security update for fastify (3 CVEs)","description":"TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.11.3-tuxcare.6.","status":"published","published":"2026-10-12T21:04:40Z","modified":"2026-10-15T09:45:52.229940845Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792233089","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 4.29.1-tuxcare.7.","status":"published","published":"2026-10-17T10:31:29Z","modified":"2026-10-17T13:09:28.819028485Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792242589","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.1-tuxcare.5.","status":"published","published":"2026-10-17T13:09:49Z","modified":"2026-10-17T19:01:11.308700171Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1794060794","title":"TuxCare security update for fastify (6 CVEs)","description":"TuxCare rebuilt fastify to address 6 CVEs. Fixed in 4.28.1-tuxcare.1.","status":"published","published":"2026-11-07T15:13:14Z","modified":"2026-11-07T19:00:36.656813145Z","updated_at":"2026-11-07T19:21:34.633914Z"}]}}