CVE-2026-84428: Fastify Header Validation Bypass Due to Incomplete Schema Case Normalization
Summary
CVE-2026-84428: fastify vulnerable to header validation bypass via incomplete schema case normalization. Affects fastify versions < 5.12.2. Fixed in 5.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js that is designed for building efficient and scalable server-side applications. It provides a robust set of features, including schema-based validation, which helps ensure that incoming requests conform to expected formats. However, a recent vulnerability has been identified that affects its header validation mechanism, potentially allowing unauthorized access to privileged paths.
Vulnerability Detail
The vulnerability arises from Fastify's incomplete normalization of header-schema property names. While Fastify lowercases top-level 'properties' keys and the root 'required' array before compiling the schema, it fails to lowercase the 'dependencies' keyword and names in nested subschemas. This oversight means that a header schema that requires one header when another is present may not match the lowercased request headers, allowing an unauthenticated remote client to bypass security controls by omitting required headers.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.12.2
This is the first release that contains the fix.
npm install fastify@5.12.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, you can write header-schema names in lowercase to ensure that 'dependencies' and other case-sensitive assertions match Node's lowercased request headers. Alternatively, enforce the cross-header requirement in an 'onRequest' or 'preValidation' hook. Here is an example of how to implement this in a hook:
fastify.addHook('onRequest', async (request, reply) => {
if (request.headers['x-admin'] && !request.headers['x-admin-token']) {
return reply.status(400).send('X-Admin-Token is required when X-Admin is present');
}
});
Conclusion
In summary, CVE-2026-84428 presents a significant security risk for applications using Fastify due to its header validation bypass. It is crucial to update to the patched version or implement workarounds to mitigate this vulnerability and protect your application from unauthorized access.
See every vulnerability recorded for fastify →
FAQ
CVE-2026-84428 is a vulnerability in Fastify that allows header validation bypass due to incomplete schema case normalization.
This vulnerability can allow unauthorized users to access privileged paths by omitting required headers, potentially compromising application security.
Versions of Fastify prior to 5.12.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
