Read the docs
TI-2026-58022 Aliases CVE-2026-84428GHSA-9q9j-q6p8-xq58

fastify vulnerable to header validation bypass via incomplete schema case normalization

Priority LOW 39CWE-178Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Partial fastify (fastify): 5.12.2fastify (npm): 5.12.2Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastifyfastifybefore 5.12.25.12.2Patch availableCNA
—fastify (npm)before 5.12.25.12.2Patch availableGHSA-9q9j-q6p8-xq58
  • fastify Vendorfastify Affected before 5.12.2 Fixed in 5.12.2 Patch available CNA
  • fastify (npm) Vendor— Affected before 5.12.2 Fixed in 5.12.2 Patch available GHSA-9q9j-q6p8-xq58

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*before 5.12.2Vulnerablefastify
  • cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:* Versions before 5.12.2 Vulnerable ·fastify

Remediation

  • Fix · CNA fastify (fastify) Fixed in 5.12.2
  • Fix · GHSA-9q9j-q6p8-xq58 fastify (npm) Fixed in 5.12.2 Advisory →

Red Hat 4 advisories

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
Show 1 more Red Hat advisories
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    fastify 5.12.2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-58050 fastify vulnerable to request validation bypass via skipped boolean false schemasPriority LOW 39
    • TI-2026-53284 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlersPriority LOW 39
    • TI-2026-58072 fastify vulnerable to request body replacement via an async validation result collisionPriority LOW 38
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Not affected: 4 products
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Dev Spaces 3.31

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84428
  2. 2026-10-03 Alias added: GHSA-9q9j-q6p8-xq58
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  6. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  7. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  8. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat

References

Advisory 3

Other 3

  • TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
  • TI-2025-23513 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass CVSS 3.1HIGH 7.5
  • TI-2026-58050 fastify vulnerable to request validation bypass via skipped boolean false schemas CVSS 3.1HIGH 7.5
  • TI-2026-53284 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVSS 3.1HIGH 7.5
  • TI-2026-26178 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header CVSS 3.1HIGH 7.5
  • TI-2026-58072 fastify vulnerable to request body replacement via an async validation result collision CVSS 3.1HIGH 8.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences