{"id":"CVE-2026-84428","aliases":["GHSA-9q9j-q6p8-xq58"],"url":"https://o3.security/vulnerability/CVE-2026-84428","summary":"fastify vulnerable to header validation bypass via incomplete schema case normalization","details":"### Impact\n\nFastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level `properties` keys and the root `required` array, and did not lowercase the JSON Schema Draft 7 `dependencies` keyword (its trigger keys and dependent property names) or names in nested subschemas. As a result, a header schema that uses `dependencies` to require one header when another is present (for example `X-Admin` requiring `X-Admin-Token`) never matches the lowercased request headers, so the dependency assertion is silently skipped. An unauthenticated remote client can send the header that activates a privileged path while omitting the header the dependency was meant to require, bypassing a schema-enforced security control. The header schema is idiomatic, valid JSON Schema Draft 7, and no custom validator, malformed request, or misconfiguration is required.\n\n### Patches\n\nHeader-schema names are now normalized across all schema positions (`properties`, `required`, `dependencies`, `dependentRequired`, `dependentSchemas`, and nested subschemas). Patched in fastify `5.12.2`. The fix is also included in the `6.0.0` release. Header schemas referenced through an external shared `$ref` (registered with `addSchema`) are not reached by this normalization and now emit an `FSTSEC002` startup warning; inline the header schema to keep case-insensitive assertions in effect.\n\n### Workarounds\n\nIf upgrading is not immediately possible, write header-schema names in lowercase so the `dependencies` and other case-sensitive assertions match Node's lowercased request headers, or enforce the cross-header requirement in an `onRequest` or `preValidation` hook instead of the schema.","published":"2026-09-04T10:24:27.809Z","modified":"2026-10-21T03:00:29.281240419Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"fastify","fixedVersion":"5.12.2"}],"fix":{"url":"https://github.com/fastify/fastify/commit/179619c8e99d54924309b9933402151ef9af37e0","label":"fastify/fastify@179619c"},"references":[{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84428.json"},{"type":"ADVISORY","url":"https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84428"},{"type":"WEB","url":"https://github.com/fastify/fastify/commit/179619c8e99d54924309b9933402151ef9af37e0"},{"type":"PACKAGE","url":"https://github.com/fastify/fastify"},{"type":"WEB","url":"https://github.com/fastify/fastify/releases/tag/v5.12.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T03:00:29.281240419Z"}}