{"id":"CVE-2026-107832","kind":"vulnerability","aliases":["CVE-2026-107832","GHSA-389g-gv7q-r4x8"],"related":[],"title":"fastify is vulnerable to header validation bypass via case-sensitive propertyNames","description":"### Impact\n\nFastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a `propertyNames` subschema's `enum` and `const`. A header-name deny-list written in the canonical header case, such as `propertyNames: { not: { enum: ['X-Debug-Override'] } }`, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a `propertyNames` deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the `not: { required: [...] }` form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 ([GHSA-9q9j-q6p8-xq58](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)), whose normalization covered header names used as property keys but not those used as values inside `propertyNames`.\n\n### Patches\n\nUsers should upgrade to fastify `5.12.6` or later, which lowercases header names held in `enum` and `const` inside a `propertyNames` subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (`propertyNames` `pattern` and `patternProperties` keys) and a `$ref` used inside `propertyNames`, are documented and, for the `$ref` case, warned at startup (`FSTSEC003`). Author those to match the lowercased request headers.\n\n### Workarounds\n\nWrite the `propertyNames` header-name constraint in lowercase (for example `enum: ['x-debug-override']`), or enforce the header check in an `onRequest` or `preValidation` hook instead of the schema.","summary":"Fastify does not lowercase header names inside a headers schema's propertyNames enum or const, so a deny-list written in canonical case (for example X-Debug-Override) never matches the lowercased request headers. An attacker can send a forbidden header that reaches the route handler even though the schema was meant to block it.","severity":"low","cvss":3.700000047683716,"epss":0.002570000011473894,"exploited":false,"exploited_at":null,"products":[{"name":"fastify","fixed":["5.12.6"],"affected":">= 5.12.2, < 5.12.6","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-178","fastify","node","npm","package"],"not_affected_if":["fastify-5.12.6-or-later","fastify-below-5.12.2","no-propertynames-header-schema","not-using-headers-schema-deny-list"],"how_to_check":"Search route schemas for propertyNames containing enum or const with uppercase header names, for example grep -rn \"propertyNames\" src/ and check the listed header names.\nCheck the installed version with npm ls fastify.","fix":"Upgrade fastify to 5.12.6 or later (npm install fastify@^5.12.6).\nUntil then, write propertyNames header-name constraints in lowercase, or enforce the header check in an onRequest or preValidation hook.","status":"open","published_at":"2026-10-13T14:17:19+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:03:28+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T20:03:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade fastify to 5.12.6 or later (npm install fastify@^5.12.6).\nUntil then, write propertyNames header-name constraints in lowercase, or enforce the header check in an onRequest or preValidation hook.","summary":"Fastify does not lowercase header names inside a headers schema's propertyNames enum or const, so a deny-list written in canonical case (for example X-Debug-Override) never matches the lowercased request headers. An attacker can send a forbidden header that reaches the route handler even though the schema was meant to block it.","category":"package","who_cares":["fastify","node","npm"],"confidence":0.85,"analyst_note":"","how_to_check":"Search route schemas for propertyNames containing enum or const with uppercase header names, for example grep -rn \"propertyNames\" src/ and check the listed header names.\nCheck the installed version with npm ls fastify.","needs_analyst":false,"not_affected_if":["fastify-below-5.12.2","fastify-5.12.6-or-later","no-propertynames-header-schema","not-using-headers-schema-deny-list"],"severity_if_unknown":"unknown"},"cost_usd":0.000458,"input_tokens":2596,"output_tokens":396,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-107832':15A,23A '-178':26B '-2026':14A,22A,221C '-84428':222C '/fastify/fastify/security/advisories/ghsa-9q9j-q6p8-xq58)),':230C '389g':18A '5.12.6':254C '9q9j':225C 'allow':170C 'allow-list':169C 'applic':160C 'attack':68B 'author':310C 'automat':285C 'block':86B 'built':206C 'built-in':205C 'bypass':7A 'cannot':282C 'canon':53B,133C 'case':10A,54B,135C,305C 'case-sensit':9A 'check':339C 'compil':97C 'const':45B,122C,265C 'constrain':173C 'constraint':181C,280C,325C 'cover':233C 'cve':13A,21A,220C 'cwe':25B 'debug':59B,143C,333C 'deni':49B,128C,166C 'deny-list':48B,127C,165C 'document':300C 'enforc':336C 'enum':43B,120C,140C,263C,330C 'even':79B 'exampl':56B,329C 'expect':183C 'express':287C 'fastifi':1A,27B,31B,88C,253C 'fastify':24A 'fix':218C 'forbidden':72B,154C 'form':195C 'fstsec003':309C 'gap':202C 'get':179C 'ghsa':17A,224C 'ghsa-389g-gv7q-r4x8':16A 'ghsa-9q9j-q6p8-xq58':223C 'github.com':229C 'github.com/fastify/fastify/security/advisories/ghsa-9q9j-q6p8-xq58)),':228C 'gv7q':19A 'handler':78B,158C 'header':5A,35B,39B,66B,73B,90C,94C,102C,112C,125C,134C,151C,155C,175C,234C,259C,276C,278C,317C,323C,338C 'header-nam':124C,277C,322C 'held':114C,261C 'hook':345C 'impact':87C 'incomplet':217C 'insid':37B,246C,266C,297C 'instead':346C 'key':239C,292C 'later':256C 'list':50B,129C,167C,171C 'lowercas':34B,64B,89C,105C,149C,189C,258C,274C,315C,327C 'match':62B,147C,272C,313C 'meant':84B 'name':36B,91C,103C,113C,126C,176C,235C,260C,279C,324C 'never':61B,146C 'node':28B 'node.js':99C 'normal':107C,208C,232C,284C 'npm':29B 'onrequest':342C 'overrid':60B,144C,334C 'packag':30B 'patch':248C 'pattern':289C 'patternproperti':291C 'prevalid':344C 'properti':238C 'propertynam':12A,42B,117C,138C,164C,247C,268C,288C,298C,321C 'q6p8':226C 'r4x8':20A 'rather':209C 'reach':75B,110C,156C 'ref':295C,304C 'regular':286C 'request':65B,101C,150C,174C,275C,316C 'requir':194C 'rout':77B 'rule':186C 'schema':40B,82B,95C,213C,349C 'send':70B 'sensit':11A 'startup':308C 'store':100C 'subschema':118C,269C 'therefor':145C 'though':80B 'unaffect':197C 'upgrad':251C 'use':162C,236C,243C,296C 'user':249C 'valid':6A 'valu':245C 'via':8A 'vulner':3A 'warn':306C 'whose':231C 'work':190C 'workaround':318C 'write':319C 'written':51B,130C,187C 'wrong':212C 'x':58B,142C,332C 'x-debug-overrid':57B,141C,331C 'xq58':227C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-13T14:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-389g-gv7q-r4x8","url":"https://github.com/advisories/GHSA-389g-gv7q-r4x8","severity":"low","published_at":"2026-10-22T16:40:35+00:00","modified_at":"2026-10-22T16:40:37+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107832","severity":null,"published_at":"2026-10-13T14:17:19+00:00","modified_at":"2026-10-15T20:38:04+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}