Improper Handling of Case Sensitivity in Fastify - CVE-2026-84428
Published: September 7, 2026
Vulnerability identifier: #VU147202
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84428
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass a schema-enforced security control.
The vulnerability exists due to improper handling of case sensitivity in Fastify header-schema normalization when processing request headers with JSON Schema Draft 7 dependencies. A remote attacker can send a header that activates a privileged path while omitting a dependent header to bypass a schema-enforced security control.
The issue affects dependency trigger keys and dependent property names, as well as names in nested subschemas, that are not normalized to match Node.js lowercased request headers.
Affected software
Fastify
How to mitigate CVE-2026-84428
Install security update from vendor's website.
Fastify - update to 5.12.2