CVE-2026-107832

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-107832

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107832.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-107832

Aliases

GHSA-389g-gv7q-r4x8

Published

2026-10-13T13:23:24Z

Modified

2026-10-15T02:31:12Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

fastify vulnerable to header validation bypass via case-sensitive propertyNames

Details

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.

Database specific

{
    "cna_assigner":  "openjs",
    "cwe_ids":  [
        "CWE-178"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107832.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "5.12.2"
                },
                {
                    "fixed":  "5.12.6"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/fastify/fastify

Affected ranges

Type

GIT

Repo

https://github.com/fastify/fastify

Events

Introduced

942a2be8704244db778f8db9a0bb4951b8825156

Fixed

ba235fdcd9a83a4c7ccf793f7b2596a8f65389b6

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "5.12.2"
        },
        {
            "fixed":  "5.12.5"
        }
    ],
    "source":  "DESCRIPTION"
}

Affected versions

v5.*

v5.12.2

v5.12.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107832.json"