Fastify Is Vulnerable To Header Validation Bypass Via Case-sensitive PropertyNames

Impact Fastify lowercases header names in a "headers" schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a "propertyNames" subschema's "enum" and "const". A header-name deny-list written in the canonical...

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

Impact Fastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header...

GHSA-389G-GV7Q-R4X8 fastify is vulnerable to header validation bypass via case-sensitive propertyNames

Impact Fastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header...

npm: fastify is vulnerable to header validation bypass via case-sensitive propertyNames

npm: fastify is vulnerable to header validation bypass via case-sensitive propertyNames vulnerability discovered by ? in WordPress npm fastify versions = 5.12.2, 5.12.6...

CVE-2026-107832

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...

CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...

CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...

CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...

CVE-2026-107832

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...

CVE-2026-107832

The fastify web framework for Node.js (versions 5.12.2 through 5.12.5 ) is vulnerable to a header validation bypass due to improper case sensitivity handling. Specifically, the routine that lowercases header names in a route schema fails to lowercase enum or const header names nested within a pro...

PT-2026-111524

Name of the Vulnerable Software and Affected Versions fastify versions 5.12.2 through 5.12.5 Description A routine used to lowercase header names declared in a route schema fails to lowercase enum or const header names nested within a propertyNames subschema. This causes header allow-lists or...