SB2026090703 - Multiple vulnerabilities in Fastify

Description

This security bulletin contains information about 4 vulnerabilities.

1) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-84428)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a schema-enforced security control.

The vulnerability exists due to improper handling of case sensitivity in Fastify header-schema normalization when processing request headers with JSON Schema Draft 7 dependencies. A remote attacker can send a header that activates a privileged path while omitting a dependent header to bypass a schema-enforced security control.

The issue affects dependency trigger keys and dependent property names, as well as names in nested subschemas, that are not normalized to match Node.js lowercased request headers.

2) Input validation error (CVE-ID: CVE-2026-84469)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass request validation.

The vulnerability exists due to improper input validation in Fastify request-part schema validation when handling requests whose body, query string, parameters, or headers are configured with a boolean false schema. A remote attacker can send a request containing arbitrary input to bypass request validation.

The documented query alias for query string schemas is also affected.

3) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-76169)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to authentication bypass using an alternate path or channel in Fastify\'s internal not-found router when processing malformed request targets for methods without a route in the main router. A remote attacker can send a malformed request to a public plugin prefix to disclose sensitive information.

Applications are affected when private or tenant fallback handlers return protected data.

4) Input validation error (CVE-ID: CVE-2026-84504)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform unauthorized state changes or disclose information.

The vulnerability exists due to improper input validation in Fastify asynchronous request schema validation when handling a request body validated by an `$async` schema. A remote user can send a crafted request body containing a `value` or `error` property to perform unauthorized state changes or disclose information.

Exploitation depends on the application dispatching operations from the schema-validated request body.

Remediation

Install update from vendor's website.

References

• https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58
• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7
• https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm