{"cve":"CVE-2026-107832","nvd":{"published":"2026-10-13T14:17:19.167","modified":"2026-10-15T20:38:04.303","status":"Awaiting Analysis","description":"fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7},"cwes":["CWE-178"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:58:52.678897993+00:00"},"epss":{"cve":"CVE-2026-107832","score":0.00257,"percentile":0.17201,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-389g-gv7q-r4x8","url":"https://osv.dev/vulnerability/GHSA-389g-gv7q-r4x8","summary":"fastify is vulnerable to header validation bypass via case-sensitive propertyNames","modified":"2026-10-22T16:45:04.287484964Z","packages":[{"ecosystem":"npm","name":"fastify","purl":"pkg:npm/fastify","ranges":[">=5.12.2 <5.12.6"],"fixed":["5.12.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}