CVE-2026-107832: falha de baixa gravidade em fastify
fastify vulnerable to header validation bypass via case-sensitive propertyNames
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7epss 0.3%
fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
fastify · fastifyCVEs relacionadas — fastify
No mesmo produto, das mais perigosas para as menos.
CVE-2022-39288HIGHDenial of service in Fastify via Content-Type headerEPSS 59.2%CVE-2026-25223HIGHFastify's Content-Type header tab character allows body validation bypassEPSS 0.9%CVE-2025-32442HIGHFastify vulnerable to invalid content-type parsing, which could lead to validation bypassEPSS 0.7%CVE-2026-25224LOWFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStreamEPSS 0.5%CVE-2026-76169HIGHfastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlersEPSS 0.5%CVE-2026-84428HIGHfastify vulnerable to header validation bypass via incomplete schema case normalizationEPSS 0.5%