CVE-2026-107832— fastify vulnerable to header validation bypass via case-sensitive propertyNames
Quick assessment
Affected
fastify fastify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Fastify 是用于 Node.js 的快速且低开销的 Web 框架。在版本 5.12.2 至 5.12.5 中，路由 schema 中声明的 HTTP 头名称大小写统一转换为小写的处理逻辑，未能正确处理嵌套在 子 schema 中的 或 字段所指定的头名称。也就是说，这些嵌套结构中的头名称没有被正确转换为小写。 因此，如果开发者使用标准格式（非小写）编写了允许的或禁止的请求头白名单/黑名单，这些规则将无法匹配实际传入的已统一小写化的头名称，从而导致被限制的头信息能够顺利通过验证并到达路由处理函数。攻击者可以利用
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107832
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
fastify vulnerable to header validation bypass via case-sensitive propertyNames
Source: CVE Program / CVE List V5
Vulnerability Description
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-107832
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107832
请登录查看更多情报信息。
Other References for CVE-2026-107832 (1)
IV. Related Vulnerabilities
Same product: fastify
-
CVE-2026-92081
fastify vulnerable to Denial of Service via unhandled except -
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplet -
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped -
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed UR -
CVE-2026-84504
fastify vulnerable to request body replacement via an async
Same vendor: fastify
-
CVE-2026-92081
fastify vulnerable to Denial of Service via unhandled except -
CVE-2026-84428
fastify vulnerable to header validation bypass via incomplet -
CVE-2026-84469
fastify vulnerable to request validation bypass via skipped -
CVE-2026-76169
fastify vulnerable to authentication bypass via malformed UR -
CVE-2026-84504
fastify vulnerable to request body replacement via an async
Same weakness: CWE-178
-
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass -
CVE-2026-108721
Open Computer Use through 1.0.0 Denylist Bypass via Case-Var -
CVE-2026-105570
Docker Sandboxes OAuth response masking could be bypassed wi -
CVE-2026-89322
Vault ACL Policy Evaluation May Allow Bypass of Deny Restric -
CVE-2026-106503
Backstage: Scaffolder action input authorization bypass
V. Comments for CVE-2026-107832
No comments yet