{"answers":{"affected":"2 open source packages ship an affected version, including fastify.","exploited":"There is no known exploitation of CVE-2026-107832 in the wild and no public exploit code.","fix":"Upgrade fastify to 5.12.6 or later.","what":"CVE-2026-107832 is a low-severity vulnerability in fastify, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-107832 and fix it if it is affected.\n\nWhat it is: CVE-2026-107832 is a low-severity vulnerability in fastify, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-107832 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- fastify (npm): affected from 5.12.2; fixed in 5.12.6\n- fastify (npm): affected from 5.12.2; fixed in 5.12.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-107832/ (Markdown: https://insights.sbomify.com/CVE-2026-107832/index.md)","id":"CVE-2026-107832","markdown":"https://insights.sbomify.com/CVE-2026-107832/index.md","name":"CVE-2026-107832","record":{"aliases":["GHSA-389g-gv7q-r4x8"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js web framework","requires_auth":"none","summary":"Attackers can bypass header validation rules in fastify by exploiting case-sensitivity issues, allowing forbidden headers to reach route handlers.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"openjs","cpe":[],"cvss":{"score":3.7,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-178","name":"Improper Handling of Case Sensitivity"}],"description":"fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"fastify vulnerable to header validation bypass via case-sensitive propertyNames","id":"CVE-2026-107832","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":2,"n_references":2,"next":{"headline":"OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion","id":"CVE-2026-107833"},"packages":[{"ecosystem":"npm","fixed":["5.12.6"],"introduced":["5.12.2"],"last_affected":[],"package":"fastify","purl":null,"source":"GHSA-389g-gv7q-r4x8"},{"ecosystem":"npm","fixed":["5.12.6"],"introduced":["5.12.2"],"last_affected":[],"package":"fastify","purl":"pkg:npm/fastify","source":"GHSA-389g-gv7q-r4x8"}],"prev":{"headline":"Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions","id":"CVE-2026-107831"},"products":["fastify"],"published":"2026-10-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["fastify"]},"summary":"Attackers can bypass header validation rules in fastify by exploiting case-sensitivity issues, allowing forbidden headers to reach route handlers.","url":"https://insights.sbomify.com/CVE-2026-107832/"}