Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-107832: fastify allows restricted header to bypass validation

CVE-2026-107832 · published 5 days ago

Summary

Versions of the fastify web framework between 5.12.2 and 5.12.5 may let a request carry a header that should be blocked because the software checks header names in the wrong case. This can let unwanted data reach your application’s code. Update fastify to version 5.12.6 or later to fix the issue.

What to do

Update fastify fastify to version 5.12.6 or later.

Affected software

Vendor	Product	Affected versions
fastify	fastify	< 5.12.6

Original advisory text

fastify vulnerable to header validation bypass via case-sensitive propertyNames

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.

References

https://cna.openjsf.org/security-advisories.html Vendor Advisory
https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-1078... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-107832 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.7 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-178Improper Handling of Case Sensitivity

Timeline

Published13 Oct 2026

Updated16 Oct 2026

First seen13 Oct 2026

Sources

CVE-2026-107832 · NVD

CVE-2026-107832 · MITRE

CVE-2026-107832 · OSV

GHSA-389g-gv7q-r4x8 · GHSA

Track software like this

Free during beta