Header validation bypass in Fastify via case-sensitive propertyNames
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Fastify versions from 5.12.2 before 5.12.6 do not lowercase header names nested in propertyNames subschemas of route schemas (CWE-178). Header allow-lists or deny-lists written with non-lowercase casing never match the lowercased incoming headers, so a restricted header reaches the route handler. A remote attacker can smuggle a forbidden header past the schema validation without privileges or user interaction, though attack complexity is high.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fastify | fastify | 5.12.2 to before 5.12.6 | 5.12.6 | Patch available | CNA |
| — | fastify (npm) | 5.12.2 to before 5.12.6 | 5.12.6 | Patch available | GHSA-389g-gv7q-r4x8 |
- fastify Vendorfastify Affected 5.12.2 to before 5.12.6 Fixed in 5.12.6 Patch available CNA
- fastify (npm) Vendor— Affected 5.12.2 to before 5.12.6 Fixed in 5.12.6 Patch available GHSA-389g-gv7q-r4x8
Remediation
Upgrade fastify to 5.12.6 or later, which is the fixed version. Until then, declare header names in lowercase in route schemas to avoid the mismatch. Red Hat lists Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) and Red Hat OpenShift Dev Spaces as affected with no fix plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
- Fix · CNA fastify (fastify) Fixed in 5.12.6
- Fix · GHSA-389g-gv7q-r4x8 fastify (npm) Fixed in 5.12.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-13 Threatist record created from CVE-2026-107832
- 2026-10-15 Affected versions changed · Red Hat
- 2026-10-15 CVSS score added · Red Hat
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-22 Alias added: GHSA-389g-gv7q-r4x8
- 2026-10-22 Fix available: npm/[email protected] · GHSA-389g-gv7q-r4x8
- 2026-10-22 CVSS score added · GHSA-389g-gv7q-r4x8
- 2026-10-22 Weakness changed · GHSA-389g-gv7q-r4x8
- 2026-10-22 8 new references · GHSA-389g-gv7q-r4x8
References
Other 7
- https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify/pull/7104
- https://github.com/fastify/fastify/commit/3241fbd2f10a8ca1503533726836b53b6e8775a2
- https://github.com/fastify/fastify/commit/35c32375731c111439682b2f9e6e0baed2694269
- https://github.com/fastify/fastify
- https://github.com/fastify/fastify/releases/tag/v5.12.6
More fastify vulnerabilities
- TI-2026-26180 @fastify/express vulnerable to middleware authentication bypass via URL normalization… CVSS 4.0CRITICAL 9.1
- TI-2026-26179 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
- TI-2026-26177 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVSS 4.0CRITICAL 9.0
- TI-2026-05498 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
- TI-2023-15307 Cross-site request forgery in npm @fastify/oauth2 CVSS 3.1HIGH 8.8
- TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
Sources
- CVE-2026-107832 · CVE Program
- CVE-2026-107832 · NVD
- FIRST EPSS
- GHSA-389g-gv7q-r4x8 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-107832 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences