Fastify Header Validation Bypass via Case-Sensitive propertyNames Subschema

CVE-2026-107832 affects Fastify versions 5.12.2 through 5.12.5 (fixed in 5.12.6). The vulnerability lives in Fastify's header schema validation pipeline: when a route schema uses a propertyNames subschema with enum or const to restrict which HTTP headers are allowed, the framework's lowercasing routine skips those nested values. Because Node.js normalizes all incoming header names to lowercase, a schema declaring "X-Admin-Token" (canonical case) in a propertyNames enum will *never* match the incoming "x-admin-token", so the validation constraint silently becomes a no-op. An attacker can send any header — including one the developer intended to block — and it sails through to the route handler unvalidated.

The vendor's LOW / 3.7 score is honest and well-calibrated. The CVSS vector correctly models this as network-reachable (AV:N) but high complexity (AC:H) because exploitation requires the application to use a *specific, uncommon* JSON Schema pattern (propertyNames with enum/const for header validation) *and* to have written those enum values in non-lowercase — a double niche. The impact ceiling is Low integrity with zero confidentiality or availability effect: the header reaches the handler, but what happens next is entirely application-dependent. Most Fastify apps never touch propertyNames for headers at all; the standard properties-based header schemas are unaffected. This is a real bug, not a phantom, but the blast radius is narrow.

Sources.

1. GHSA-389g-gv7q-r4x8 — GitHub Security Advisory
2. CVE-2026-107832 — ThreatInt CVE Database
3. CVE-2026-107832 — Hol Security Guard
4. CVE-2026-107832 — Strix AI
5. Fastify Releases — GitHub
6. Fastify Validation and Serialization Docs
7. CWE-178: Improper Handling of Case Sensitivity — MITRE

Run this on any host where the Fastify application is deployed, or in your CI pipeline against the project's node_modules. Requires read access to node_modules/fastify/package.json. Example: bash check_cve_2026_107832.sh /app where /app is the project root. No elevated privileges needed.

#!/usr/bin/env bash
# check_cve_2026_107832.sh — detect CVE-2026-107832 in fastify
# Usage: bash check_cve_2026_107832.sh [PROJECT_ROOT]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PROJECT_ROOT="${1:-.}"
PKG="${PROJECT_ROOT}/node_modules/fastify/package.json"

if [ ! -f "$PKG" ]; then
  echo "UNKNOWN — fastify not found in ${PROJECT_ROOT}/node_modules"
  exit 2
fi

VERSION=$(grep '"version"' "$PKG" | head -1 | sed 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse version from $PKG"
  exit 2
fi

echo "Detected fastify version: $VERSION"

# Parse semver components
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3 | cut -d- -f1)

# Affected: >=5.12.2 and <5.12.6
if [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 12 ] && [ "$PATCH" -ge 2 ] && [ "$PATCH" -lt 6 ]; then
  echo "VULNERABLE — fastify $VERSION is affected by CVE-2026-107832"
  echo "  Upgrade to 5.12.6+: npm install [email protected]"
  echo "  Workaround: lowercase all enum/const values in propertyNames header schemas"
  exit 1
else
  echo "PATCHED — fastify $VERSION is not in the affected range (5.12.2–5.12.5)"
  exit 0
fi