fastify is vulnerable to header validation bypass via case-sensitive propertyNames

影響: npm:fastify >= 5.12.2, < 5.12.6 → 5.12.6

Fastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header case, such as propertyNames: { not: { enum: ['X-Debug-Override'] } }, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a propertyNa…

GitHub Advisory Database에서 읽기

2026. 10. 23. 오전 01:40, GitHub Advisory Database에서 "fastify is vulnerable to header validation bypass via case-sensitive propertyNames"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-107832.