---
id: "CVE-2026-107832"
kind: "vulnerability"
aliases: ["CVE-2026-107832", "GHSA-389g-gv7q-r4x8"]
title: "fastify is vulnerable to header validation bypass via case-sensitive propertyNames"
severity: "low"
cvss: 3.700000047683716
epss: 0.002570000011473894
exploited: false
status: "open"
category: "package"
products: [{"name": "fastify", "fixed": ["5.12.6"], "affected": ">= 5.12.2, < 5.12.6", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-178", "fastify", "node", "npm", "package"]
not_affected_if: ["fastify-5.12.6-or-later", "fastify-below-5.12.2", "no-propertynames-header-schema", "not-using-headers-schema-deny-list"]
published_at: "2026-10-13T14:17:19+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-389g-gv7q-r4x8", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107832", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# fastify is vulnerable to header validation bypass via case-sensitive propertyNames

Fastify does not lowercase header names inside a headers schema's propertyNames enum or const, so a deny-list written in canonical case (for example X-Debug-Override) never matches the lowercased request headers. An attacker can send a forbidden header that reaches the route handler even though the schema was meant to block it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:fastify affected >= 5.12.2, < 5.12.6 fixed 5.12.6

## How to check

Search route schemas for propertyNames containing enum or const with uppercase header names, for example grep -rn "propertyNames" src/ and check the listed header names.
Check the installed version with npm ls fastify.

## Fix

Upgrade fastify to 5.12.6 or later (npm install fastify@^5.12.6).
Until then, write propertyNames header-name constraints in lowercase, or enforce the header check in an onRequest or preValidation hook.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-389g-gv7q-r4x8
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107832

## From the sources

### Impact

Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a `propertyNames` subschema's `enum` and `const`. A header-name deny-list written in the canonical header case, such as `propertyNames: { not: { enum: ['X-Debug-Override'] } }`, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a `propertyNames` deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the `not: { required: [...] }` form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 ([GHSA-9q9j-q6p8-xq58](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)), whose normalization covered header names used as property keys but not those used as values inside `propertyNames`.

### Patches

Users should upgrade to fastify `5.12.6` or later, which lowercases header names held in `enum` and `const` inside a `propertyNames` subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (`propertyNames` `pattern` and `patternProperties` keys) and a `$ref` used inside `propertyNames`, are documented and, for the `$ref` case, warned at startup (`FSTSEC003`). Author those to match the lowercased request headers.

### Workarounds

Write the `propertyNames` header-name constraint in lowercase (for example `enum: ['x-debug-override']`), or enforce the header check in an `onRequest` or `preValidation` hook instead of the schema.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_