{"uuid": "07c0b978-9a6d-4742-b4ec-8a8cd224402d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84428", "type": "seen", "source": "https://gist.github.com/alon710/f2478353e7cea49382c0078891298de2", "content": "# CVE-2026-84428: CVE-2026-84428: Schema Validation Bypass in Fastify Header Normalization\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84428\n\n## Summary\nA validation bypass vulnerability exists in Fastify web framework prior to version 5.12.2. The flaw stems from shallow normalization of header validation schemas, which fails to lowercase nested or conditional schema rules (like JSON Schema dependencies or dependentRequired) defined in mixed or canonical casing. Consequently, because Node.js normalizes incoming HTTP request headers to lowercase, the compiled validator fails to match these headers against the un-normalized mixed-case schema triggers, silently skipping conditional checks and allowing unauthenticated attackers to bypass authorization or security headers.\n\n## TL;DR\nA shallow header-schema normalization bug in Fastify < 5.12.2 allows unauthenticated remote attackers to bypass critical conditional header validation rules, silently skipping security checks if trigger headers are defined in mixed-case.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: Improper Handling of Case Sensitivity (CWE-178)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 7.5 (High)\n- **EPSS Score**: 0.00524 (Percentile: 42.21%)\n- **Exploit Maturity**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Fastify < 5.12.2\n- **Fastify**: < 5.12.2 (Fixed in: `5.12.2`)\n\n## Mitigation\n\n- Upgrade Fastify to version 5.12.2 or higher to enable deep recursive schema normalization.\n- Inline all header validation schemas instead of using external definitions referenced via $ref.\n- Manually normalize all validation schemas to lowercase for both properties and conditional triggers.\n- Implement programmatic preHandler hooks as a defense-in-depth security layer to manually verify critical headers.\n\n**Remediation Steps:**\n1. Execute `npm install fastify@latest` or `yarn upgrade fastify` to pull Fastify v5.12.2+.\n2. Search your application log output for the Fastify Security Warning code `FSTSEC002`.\n3. Identify any schemas causing this warning and refactor them to inline their schemas instead of using external `$ref` statements.\n4. Review header schema configurations and convert mixed-case property and dependency declarations to lowercase for consistency.\n\n## References\n\n- [GHSA-9q9j-q6p8-xq58: Case insensitivity bypass in header validation schemas](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)\n- [NVD - CVE-2026-84428](https://nvd.nist.gov/vuln/detail/CVE-2026-84428)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84428) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T12:30:29.000000Z"}