CVE-2026-107832
Received Received - Intake

Case-Sensitive Header Validation Bypass in Fastify

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: openjs

Description
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-107832
EUVD
EUVD-2026-98697

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fastify fastify 5.12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Fastify versions 5.12.2 through 5.12.5. It involves improper handling of case sensitivity in header name validation. Fastify lowercases header names during schema compilation but fails to lowercase header names nested inside propertyNames subschemas. This allows attackers to bypass case-sensitive header restrictions by sending headers with canonical casing, which bypasses validation and reaches the route handler.

Detection Guidance

To detect this vulnerability, check if your Fastify version is between 5.12.2 and 5.12.5. Run: node -e "console.log(require('fastify/package.json').version)". If the output is within this range, the system is vulnerable.

Impact Analysis

An attacker could exploit this to smuggle forbidden headers past security checks, potentially altering request handling or bypassing security restrictions. This could lead to unauthorized actions, data leaks, or manipulation of application behavior. The impact is limited by the need for network access and high attack complexity.

Compliance Impact

This vulnerability could undermine compliance by allowing unauthorized header manipulation, potentially violating data protection requirements. For example, it might enable bypassing security headers or altering request metadata, which could conflict with GDPR's integrity principles or HIPAA's access controls. However, the specific compliance impact depends on the application's use of header validation.

Mitigation Strategies

Upgrade Fastify to version 5.12.6 or later. Use: npm update fastify or npm install fastify@latest. Alternatively, rewrite header constraints in lowercase or enforce checks via hooks as temporary workarounds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107832. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart