CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...

CVE-2026-107832

The fastify web framework for Node.js (versions 5.12.2 through 5.12.5 ) is vulnerable to a header validation bypass due to improper case sensitivity handling. Specifically, the routine that lowercases header names in a route schema fails to lowercase enum or const header names nested within a pro...

CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...

PT-2026-111524

Name of the Vulnerable Software and Affected Versions fastify versions 5.12.2 through 5.12.5 Description A routine used to lowercase header names declared in a route schema fails to lowercase enum or const header names nested within a propertyNames subschema. This causes header allow-lists or...

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

PT-2026-76583

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.1.13 Libevent versions prior to 2.2.2-alpha Description Two HTTP parsing weaknesses exist in the http.c file. The function evhttp decode uri internal decodes percent-encoded %00 bytes into literal NUL characters,...

CVE-2026-54106

CVE-2026-54106 affects the U.S. GAO EPDS and CBCA EDS login flow, where X-Forwarded-For headers are not validated. The underlying issue allows a remote attacker who has compromised administrator credentials to bypass network access controls and log in, potentially gaining access to restricted doc...

CVE-2026-26308 Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC Role-Based Access Control filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating eac...

Validation Bypass

Fastify is vulnerable to validation bypass. The vulnerability is due to improper normalization and matching of the Content-Type header, allowing attackers to evade validation by altering casing or whitespace...