{"id":"ghsa-ghsa-389g-gv7q-r4x8","seq":309564,"kind":"advisory","title":"fastify is vulnerable to header validation bypass via case-sensitive propertyNames","url":"https://github.com/advisories/GHSA-389g-gv7q-r4x8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-389g-gv7q-r4x8","summary":"影響: npm:fastify >= 5.12.2, < 5.12.6 → 5.12.6\nFastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header case, such as propertyNames: { not: { enum: ['X-Debug-Override'] } }, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a propertyNa…","severity":"low","techs":["nodejs"],"cves":["CVE-2026-107832"],"tags":["GHSA-389g-gv7q-r4x8","fastify"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:40:35.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}