CVE-2026-107832 Overview
CVE-2026-107832 is a header validation bypass in Fastify, a web framework for Node.js. The flaw affects versions 5.12.2 through 5.12.5. Fastify's routine that lowercases header names declared in a route schema fails to lowercase enum or const header names nested inside a propertyNames subschema. Allow-list or deny-list rules written with canonical (non-lowercase) casing never match the incoming lowercased header. A restricted header passes validation and reaches the route handler. The weakness is tracked as [CWE-178: Improper Handling of Case Sensitivity].
Critical Impact
Attackers can smuggle a forbidden header past schema-based validation, undermining the integrity of request handling in Fastify applications that rely on case-sensitive header rules.
Affected Products
- Fastify 5.12.2
- Fastify 5.12.3, 5.12.4, 5.12.5
- Node.js applications using Fastify route schemas with propertyNames header rules
Discovery Timeline
- 2026-10-13 - CVE-2026-107832 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-107832
Vulnerability Analysis
Fastify validates incoming request headers against JSON Schema definitions attached to routes. Because HTTP header names are case-insensitive, Fastify normalizes schema-declared header names to lowercase before matching them against the lowercased headers it receives from Node.js. This normalization logic walks the common locations where header names appear in a schema, including top-level properties.
The normalization step does not descend into propertyNames subschemas when those subschemas express the header allow-list or deny-list through enum or const keywords. Any header name declared with mixed or uppercase casing inside such a subschema remains in its original form. When Fastify compares the normalized incoming header against the still-canonical schema value, the comparison fails and the restricted header is accepted as if it were permitted.
The downstream effect is a validation bypass. Routes that depend on propertyNames enumerations to block sensitive headers, such as authorization or routing metadata, forward those headers to the handler. This affects request integrity but does not expose confidentiality or availability directly.
Root Cause
The root cause is incomplete case normalization of schema keywords. The lowercase helper traverses properties and similar nodes but omits enum and const entries nested inside propertyNames. The result is a mismatch between the case-insensitive header namespace in HTTP and the case-sensitive comparison performed by the validator.
Attack Vector
An attacker sends an HTTP request to a Fastify route that defines a header allow-list or deny-list through a propertyNames subschema using non-lowercase header names. The attacker includes a restricted header, which Node.js delivers to Fastify in lowercase. Validation does not match the restricted entry, and the header reaches application logic that assumed it had been filtered.
No verified public exploit code is available for this issue. See the GitHub Security Advisory GHSA-389g-gv7q-r4x8 for the maintainer's technical description.
Detection Methods for CVE-2026-107832
Indicators of Compromise
- Requests containing headers that a route's documented allow-list or deny-list should have rejected but that still reach handler code.
- Application logs showing handler branches executing on headers expected to be filtered by the schema layer.
- Package manifests pinning fastify@5.12.2 through fastify@5.12.5.
Detection Strategies
- Audit route schemas for propertyNames constructs containing enum or const entries with mixed-case header names.
- Add unit tests that submit lowercase variants of restricted headers to verify the schema rejects them.
- Instrument request logging to capture headers observed at the handler versus those declared in schema rules.
Monitoring Recommendations
- Monitor dependency manifests and lockfiles for Fastify versions in the vulnerable range.
- Alert on anomalous presence of sensitive headers, such as authorization or forwarding headers, on routes that document them as restricted.
- Track application telemetry for schema validation outcomes to detect patterns of accepted-but-restricted headers.
How to Mitigate CVE-2026-107832
Immediate Actions Required
- Upgrade Fastify to version 5.12.6 or later across all services and build pipelines.
- Inventory route schemas that use propertyNames with enum or const header rules and confirm they are enforced after the upgrade.
- Rebuild and redeploy container images that bundle vulnerable Fastify versions.
Patch Information
The maintainers fixed the issue in Fastify 5.12.6 by extending the header-name lowercasing routine to traverse enum and const values inside propertyNames subschemas. Patch details are published in the GitHub Security Advisory GHSA-389g-gv7q-r4x8 and the OpenJS Foundation Security Advisories.
Workarounds
- Declare all header names in route schemas in lowercase so validation matches incoming headers regardless of the Fastify version.
- Apply redundant header filtering in a preHandler hook or upstream proxy for defense in depth.
- Restrict handler logic from acting on sensitive headers without an explicit secondary allow-list check.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.