CVE-2026-84428
Received Received - Intake

Fastify Header Dependency Bypass via Case-Insensitive Schema Handling

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-84428
EUVD
EUVD-2026-70998

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
fastify fastify to 5.12.2 (exc)
fastify fastify 5.12.2
fastify fastify 6.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Fastify versions before 5.12.2. It involves incomplete case normalization of HTTP header names in route schemas. Fastify lowercases top-level properties and required arrays but misses the dependencies keyword in JSON Schema Draft 7. This allows attackers to bypass security checks by sending a header that triggers a privileged path without including a required dependent header.

Detection Guidance

To detect this vulnerability, check the Fastify version in use with: npm list fastify. If the version is below 5.12.2, the system is vulnerable. Review header schemas using dependencies in routes for case-sensitive mismatches.

Impact Analysis

An unauthenticated remote attacker could exploit this to bypass authentication or authorization checks. For example, if a privileged-mode header requires an authentication header via dependencies, the attacker can send the privileged-mode header alone, skipping the required auth header. This could grant unauthorized access to sensitive functionality or data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for access controls and data protection. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Fastify to version 5.12.2 or later. If upgrading is not possible, rewrite header-schema names in lowercase or enforce requirements in an onRequest or preValidation hook. Avoid external $ref for header schemas.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart