Improper Handling of Case Sensitivity in Fastify - CVE-2026-107832
Published: November 6, 2026
Vulnerability identifier: #VU159839
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107832
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass request header restrictions and pass forbidden headers to Fastify handlers.
The vulnerability exists due to incomplete case normalization in Fastify header schema validation when applications use mixed-case header names in enum or const constraints inside a propertyNames deny-list. An unauthenticated remote attacker can send a forbidden header whose lowercased name fails to match the configured restriction.
Affected software
Fastify
How to mitigate CVE-2026-107832
Install security update from vendor's website.
Fastify - update to 5.12.6