Header Validation Bypass in Fastify Web Framework by Node.js
CVE-2026-107832

3.7LOW

Key Information:

Vendor

Fastify

Status
Fastify
Vendor
CVE Published:
13 October 2026

What is CVE-2026-107832?

A vulnerability exists in Fastify, a low overhead web framework for Node.js, where the header name lowercasing routine fails to properly handle enum or const header names nested within propertyNames subschemas. This oversight allows a header allow-list or deny-list configured in canonical form (non-lowercase) to not match incoming lowercased headers. Consequently, attackers can exploit this flaw to smuggle forbidden headers past the validation process, ultimately compromising the integrity of request handling. Users are strongly encouraged to upgrade to Fastify version 5.12.6 or later to mitigate this issue. Declaring header names in lowercase can provide a temporary workaround.

Affected Version(s)

fastify 5.12.2 < 5.12.6

fastify 5.12.6

References

https://github.com/fastify/fastify/security/advisories/GH...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

uttej-badwane
mcollina
UlisesGascon
kian0417
.