{"schema":"threatline.record/2","record":{"id":"CVE-2026-84428","aliases":["GHSA-9q9j-q6p8-xq58"],"summary":"fastify vulnerable to header validation bypass via incomplete schema case normalization","details":"### Impact\n\nFastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level `properties` keys and the root `required` array, and did not lowercase the JSON Schema Draft 7 `dependencies` keyword (its trigger keys and dependent property names) or names in nested subschemas. As a result, a header schema that uses `dependencies` to require one header when another is present (for example `X-Admin` requiring `X-Admin-Token`) never matches the lowercased request headers, so the dependency assertion is silently skipped. An unauthenticated remote client can send the header that activates a privileged path while omitting the header the dependency was meant to require, bypassing a schema-enforced security control. The header schema is idiomatic, valid JSON Schema Draft 7, and no custom validator, malformed request, or misconfiguration is required.\n\n### Patches\n\nHeader-schema names are now normalized across all schema positions (`properties`, `required`, `dependencies`, `dependentRequired`, `dependentSchemas`, and nested subschemas). Patched in fastify `5.12.2`. The fix is also included in the `6.0.0` release. Header schemas referenced through an external shared `$ref` (registered with `addSchema`) are not reached by this normalization and now emit an `FSTSEC002` startup warning; inline the header schema to keep case-insensitive assertions in effect.\n\n### Workarounds\n\nIf upgrading is not immediately possible, write header-schema names in lowercase so the `dependencies` and other case-sensitive assertions match Node's lowercased request headers, or enforce the cross-header requirement in an `onRequest` or `preValidation` hook instead of the schema.","categories":["Frameworks"],"product":"fastify","vendor":"fastify","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9q9j-q6p8-xq58","source_modified_at":"2026-09-30T23:44:29Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fastify"},"range":"< 5.12.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84428","source_modified_at":"2026-09-04T16:06:04.123Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"fastify","vendor":"fastify","versions":[{"versionType":"semver","status":"affected","version":"0","lessThan":"5.12.2"},{"versionType":"semver","status":"unaffected","version":"5.12.2"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9q9j-q6p8-xq58","source_modified_at":"2026-10-01T00:00:05.759936763Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fastify","ecosystem":"npm","purl":"pkg:npm/fastify"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.12.2"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9q9j-q6p8-xq58","source_modified_at":"2026-09-30T23:44:29Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fastify"},"version":"5.12.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84428","source_modified_at":"2026-09-04T16:06:04.123Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fastify","ecosystem":null},"version":"5.12.2","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9q9j-q6p8-xq58","source_modified_at":"2026-10-01T00:00:05.759936763Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fastify","ecosystem":"npm","purl":"pkg:npm/fastify"},"version":"5.12.2"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00524,"percentile":0.4366,"score_date":"2026-10-23"},"published_at":"2026-09-04T10:24:27.809Z","modified_at":"2026-10-01T00:00:05.759936763Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-9q9j-q6p8-xq58","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T23:44:29Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-84428","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-04T16:06:04.123Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-9q9j-q6p8-xq58","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-01T00:00:05.759936763Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84428","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84428","source":"GitHub Advisory Database"},{"url":"https://github.com/fastify/fastify/commit/179619c8e99d54924309b9933402151ef9af37e0","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.2","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-9q9j-q6p8-xq58","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-04T16:04:59.730612Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T00:00:05.759936763Z","content_hash":"39b68b915d40e2d4eb601041798b03772da42446ac5bac826d98f55aa19908da"}}