fastify is vulnerable to header validation bypass via case-sensitive propertyNames

影響: npm:fastify >= 5.12.2, < 5.12.6 → 5.12.6

Fastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header case, such as propertyNames: { not: { enum: ['X-Debug-Override'] } }, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a propertyNa…

Read on GitHub Advisory Database

On 10/23/2026, 01:40 AM, GitHub Advisory Database published "fastify is vulnerable to header validation bypass via case-sensitive propertyNames" (type: Advisory). Severity is "Low" (low). Related technologies: JavaScript / Node.js. CVE: CVE-2026-107832.