CVE-2026-84428: Fastify Header Validation Bypass Due to Incomplete Schema Case Normalization

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Fastify is a web framework for Node.js that is designed for building efficient and scalable server-side applications. It provides a robust set of features, including schema-based validation, which helps ensure that incoming requests conform to expected formats. However, a recent vulnerability has been identified that affects its header validation mechanism, potentially allowing unauthorized access to privileged paths.

Vulnerability Detail

The vulnerability arises from Fastify's incomplete normalization of header-schema property names. While Fastify lowercases top-level 'properties' keys and the root 'required' array before compiling the schema, it fails to lowercase the 'dependencies' keyword and names in nested subschemas. This oversight means that a header schema that requires one header when another is present may not match the lowercased request headers, allowing an unauthenticated remote client to bypass security controls by omitting required headers.

npm install fastify@5.12.7

npm install fastify@5.12.2

Workaround

If upgrading is not immediately feasible, you can write header-schema names in lowercase to ensure that 'dependencies' and other case-sensitive assertions match Node's lowercased request headers. Alternatively, enforce the cross-header requirement in an 'onRequest' or 'preValidation' hook. Here is an example of how to implement this in a hook:

fastify.addHook('onRequest', async (request, reply) => {
  if (request.headers['x-admin'] && !request.headers['x-admin-token']) {
    return reply.status(400).send('X-Admin-Token is required when X-Admin is present');
  }
});

Conclusion

In summary, CVE-2026-84428 presents a significant security risk for applications using Fastify due to its header validation bypass. It is crucial to update to the patched version or implement workarounds to mitigate this vulnerability and protect your application from unauthorized access.

See every vulnerability recorded for fastify →

FAQ