CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames
Attackers can bypass header validation rules in fastify by exploiting case-sensitivity issues, allowing forbidden headers to reach route handlers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107832?
CVE-2026-107832 is a low-severity vulnerability in fastify, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.
Weakness: CWE-178
Which versions are affected by CVE-2026-107832?
2 open source packages ship an affected version, including fastify.
| Package | Affected | Fixed in |
|---|---|---|
fastify npm | From 5.12.2 | 5.12.6 |
fastify npm | From 5.12.2 | 5.12.6 |
How do I fix CVE-2026-107832?
Upgrade fastify to 5.12.6 or later.
Is CVE-2026-107832 being exploited?
There is no known exploitation of CVE-2026-107832 in the wild and no public exploit code.
Sources
Also known as GHSA-389g-gv7q-r4x8.