HTTP Header Name Bypass in Fastify by Fastify, Inc.

CVE-2026-84428

What is CVE-2026-84428?

Fastify versions prior to 5.12.2 do not completely enforce the case-insensitivity of HTTP header names in route header schemas, leading to potential security risks. Although the framework lowercases property keys and the root-level required array during compilation, it fails to lowercase trigger and dependent names in the JSON Schema Draft 7 dependencies keyword. This oversight allows an unauthorized remote client to activate privileged functionalities by manipulating headers, bypassing necessary authentication checks. Users are advised to upgrade to Fastify version 5.12.2 or later to address this vulnerability.

References