## fastify is vulnerable to header validation bypass via case-sensitive propertyNames

- 種別: advisory
- 重大度: low
- 関連技術: nodejs
- CVE: CVE-2026-107832
- 公開日時: 2026-10-22T16:40:35.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-389g-gv7q-r4x8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-389g-gv7q-r4x8

影響: npm:fastify >= 5.12.2, < 5.12.6 → 5.12.6
Fastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header case, such as propertyNames: { not: { enum: ['X-Debug-Override'] } }, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a propertyNa…