CVE-2026-84428 PUBLISHED

fastify vulnerable to header validation bypass via incomplete schema case normalization

Assigner: openjs
Reserved: 01.09.2026 Published: 04.09.2026 Updated: 04.09.2026

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 7.5

Product Status

Vendor fastify
Product fastify
Versions Default: unaffected
  • affected from 0 to 5.12.2 (excl.)
  • Version 5.12.2 is unaffected

Credits

  • schecthellraiser606 reporter
  • mcollina remediation developer
  • UlisesGascon remediation developer

References

Problem Types

  • CWE-178: Improper Handling of Case Sensitivity CWE