CVE-2026-84428 Overview
CVE-2026-84428 is an authorization bypass vulnerability in the Fastify Node.js web framework affecting versions before 5.12.2. The flaw stems from an incomplete case-insensitive transformation applied to route header schemas. Fastify lowercases property keys and the root-level required array but fails to lowercase trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node.js stores request header names in lowercase, canonical-case header dependencies never match at runtime. An unauthenticated remote client can send a header that activates a privileged branch while omitting the header the schema was supposed to require. The issue is tracked under [CWE-178] (Improper Handling of Case Sensitivity).
Critical Impact
Unauthenticated remote attackers can bypass conditional header dependency checks, activating privileged code paths without providing the required authentication headers.
Affected Products
- Fastify web framework versions prior to 5.12.2
- Applications defining route header schemas that rely on the JSON Schema dependencies keyword
- Node.js services using Fastify for HTTP routing and validation
Discovery Timeline
- 2026-09-04 - CVE-2026-84428 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-84428
Vulnerability Analysis
Fastify normalizes HTTP header validation by lowercasing header names before compiling the route schema. This normalization is required because Node.js exposes incoming request headers in lowercase form. The transformation, however, only reaches two locations in the schema tree: the properties object keys and the root-level required array.
The JSON Schema Draft 7 dependencies keyword defines conditional presence rules. A schema author might specify that when a header such as X-Privileged-Mode is present, the header Authorization must also be present. Fastify does not lowercase the trigger key or the dependent names inside this construct.
At validation time, the schema looks for the canonical-case header names, but the request object only contains lowercase equivalents. The presence assertion silently evaluates as satisfied, and the dependent check is skipped.
Root Cause
The root cause is an incomplete case-folding transformation on user-supplied header schemas. Case sensitivity handling omits the dependencies sub-tree, producing a mismatch between validation logic and the runtime header namespace maintained by Node.js.
Attack Vector
Exploitation requires no authentication, no user interaction, and only a single network request. An attacker crafts an HTTP request that includes the trigger header defined in the schema while deliberately omitting the header it depends on. The validator accepts the request, and the route handler executes the privileged branch. This bypass affects integrity guarantees enforced through header dependency rules, including authentication token requirements gated by mode-selection headers.
No verified public exploit code has been observed. See the GitHub Advisory GHSA-9q9j-q6p8-xq58 for maintainer details.
Detection Methods for CVE-2026-84428
Indicators of Compromise
- Requests containing a schema-defined trigger header without the accompanying dependent header reaching privileged route handlers.
- Application logs showing successful invocations of privileged code paths with missing authentication or authorization headers.
- Anomalous HTTP request patterns targeting endpoints that use dependencies in their header schema.
Detection Strategies
- Audit route definitions for any header schema using the JSON Schema dependencies keyword with mixed-case header names.
- Instrument request middleware to log the header set on every privileged route invocation and compare against expected dependency rules.
- Replay recent access logs against a patched Fastify instance and flag requests that would now be rejected.
Monitoring Recommendations
- Forward Fastify application logs to a centralized analytics platform and alert on privileged endpoint access lacking expected authentication headers.
- Track the deployed Fastify version across services using software composition analysis to identify hosts still running versions below 5.12.2.
- Monitor egress and downstream systems for actions triggered by requests that should have failed header validation.
How to Mitigate CVE-2026-84428
Immediate Actions Required
- Upgrade Fastify to version 5.12.2 or later across all affected services.
- Inventory route schemas that use the dependencies keyword and confirm they behave as expected after the upgrade.
- Review recent access logs for requests that may have exploited the bypass prior to patching.
Patch Information
The Fastify maintainers released version 5.12.2, which extends the case-folding transformation to trigger and dependent names inside the dependencies keyword. Details are available in the GitHub Advisory GHSA-9q9j-q6p8-xq58 and the OpenJS Foundation Security Advisories.
Workarounds
- Rewrite route header schemas to use lowercase header names for every trigger and dependent entry inside the dependencies keyword.
- Add an explicit pre-handler hook that enforces the required header presence in code rather than relying solely on schema validation.
- Restrict access to endpoints that rely on header dependency rules using upstream authentication or a web application firewall until the upgrade is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
