CVE-2026-107832

Executive Summary

CVE-2026-107832 is a header validation bypass in the Fastify Node.js web framework, affecting versions 5.12.2 through 5.12.5. The flaw resides in the route-schema routine that lowercases declared header names: it fails to lowercase enum or const header names nested inside a propertyNames subschema, so an allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased HTTP header. As a result, a restricted header can pass schema validation and reach the route handler, undermining the integrity of request-handling logic for any Fastify application that enforces header policy through route schemas using non-lowercase names.

Technical Analysis

Fastify is a fast, low-overhead web framework for Node.js. In the affected versions, a normalization defect exists in the code path that processes header names declared within a route schema. HTTP header names are case-insensitive by specification, and Fastify normalizes incoming request header names to lowercase before schema validation occurs. To keep schema definitions consistent with this normalization, Fastify lowercases header names declared in the route schema prior to comparison.

The defect (classified as CWE-178, Improper Handling of Case Sensitivity) is that this lowercasing routine does not recurse into, or otherwise process, enum or const header names that are nested inside a propertyNames subschema. When a developer writes a header allow-list or deny-list using canonical casing (for example, a header name that contains uppercase characters rather than the all-lowercase form), the schema retains the non-lowercased literal. During validation, the incoming request header has already been lowercased, so the comparison against the schema's non-lowercased enum/const value fails to match. The practical consequence is inverted from the developer's intent: a header that was intended to be restricted (denied or excluded by the schema) instead passes validation and is delivered to the route handler.

The attack surface is the HTTP request-handling path of any Fastify service whose routes enforce header policy via JSON-Schema validation using propertyNames combined with enum or const, and whose declared header names are not written in all-lowercase form. The vulnerability is a validation-logic bypass, not a memory-safety or injection flaw. It affects the integrity of request handling — specifically, the guarantee that forbidden headers are rejected before reaching application logic — without directly affecting confidentiality or availability. The CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, score 3.7) reflects a network-reachable, unauthenticated condition requiring a high-complexity precondition (the specific non-lowercase schema construct must be present) with limited integrity impact. The precise internal function that performs the lowercasing is not identified in the available description; no function, class, or file names beyond the schema keywords (enum, const, propertyNames) are disclosed, and none should be assumed.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (case-sensitivity validation bypass) and the documented behavior; no specific implementation details are fabricated.

1. Reconnaissance / target identification. An attacker identifies a Fastify service running an affected version (5.12.2–5.12.5). Because the defect manifests only under a specific schema construct, the attacker must determine (or assume) that the target enforces header policy through a route schema using propertyNames with enum/const header names written in non-lowercase casing. This is an application-configuration-dependent precondition, consistent with the AC:H rating.

2. Triggering the flaw class. The attacker crafts an HTTP request that includes a header which, per the application's intended policy, should have been rejected by the schema. The attacker transmits the header in the conventional form. Fastify lowercases the incoming header name during request processing, while the schema's enum/const value retains its canonical casing. The two never match, so the intended allow-list/deny-list comparison silently fails to block the header.

3. Payload / execution. No code execution or special payload is required; the "payload" is simply the presence of the otherwise-forbidden header in an otherwise normal request to a route whose handler trusts that validated header policy has been applied. The attacker does not exploit a memory-safety or injection primitive — the bypass is purely a logic error in validation.

4. Post-exploitation impact. The forbidden header reaches the route handler despite the schema's declared restriction. Any downstream logic that trusts the header's absence or presence — for example, header-driven access, routing, or trust decisions — may be influenced. The impact is limited to integrity of request handling (CVSS I:L); there is no direct confidentiality or availability impact described.

Impact Assessment

The blast radius is confined to Fastify applications that (a) run versions 5.12.2–5.12.5 and (b) enforce header restrictions via route schemas using propertyNames with enum/const header names that are not all-lowercase. For such applications, a header the developer intended to block can be smuggled past validation and processed by the handler, potentially altering request handling behavior. The CVSS vector indicates: network attack vector (AV:N), high attack complexity (AC:H) due to the required schema precondition, no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), limited integrity impact (I:L), and no availability impact (A:N). The base score is 3.7 (Low). CISA KEV status is NO, and no exploit-in-the-wild activity is reported.

Detection Guidance

Detection for this flaw is challenging because exploitation produces no malformed packets or anomalous signatures — it is a semantic bypass producing normal-looking HTTP traffic. The most reliable detections focus on (a) the presence of headers a given route should never receive and (b) application/telemetry signals tied to header validation outcomes.

Sigma Rule

title: Fastify Header Validation Bypass - Forbidden Header Reaching Route Handler
id: 6b1f9c2a-7d3e-4a51-9ف
status: experimental
description: Detects requests where headers normally restricted by a Fastify route schema reach the handler due to the case-sensitivity normalization bypass in versions 5.12.2-5.12.5.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107832
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: fastify
detection:
  selection_framework:
    http.status: 2xx
  selection_suspicious_headers:
    http.request.headers|contains:
      - 'x-forwarded-'
      - 'x-original-'
      - 'x-override-'
      - 'x-admin-'
  condition: selection_framework and selection_suspicious_headers
falsepositives:
  - Legitimate use of proxy/forwarding headers
  - Applications that intentionally accept these headers
level: low
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.107832

YARA Rule

rule CVE_2026_107832_Fastify_Header_Case_Bypass
{
    meta:
        description = "Detects Fastify route schema constructs using propertyNames with enum/const headers that may be vulnerable to the case-sensitivity bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107832"
        date = "2026-01-01"
        severity = "low"

    strings:
        $schema_kw1 = "propertyNames" ascii
        $schema_kw2 = "\"enum\"" ascii
        $schema_kw3 = "\"const\"" ascii
        $fastify_ver_1 = "5.12.2" ascii
        $fastify_ver_2 = "5.12.3" ascii
        $fastify_ver_3 = "5.12.4" ascii
        $fastify_ver_4 = "5.12.5" ascii

    condition:
        filesize < 5MB and
        $schema_kw1 and ($schema_kw2 or $schema_kw3) and
        any of ($fastify_ver_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107832 Fastify Header Validation Bypass Attempt"; flow:established,to_server; http.header_names; content:"|0d 0a|"; pcre:"/^(?:X-(?:Forwarded|Original|Override|Admin|Real)-[A-Za-z-]+):/mHi"; sid:2026107832; rev:1; reference:cve,2026-107832; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107832; classtype:attempted-recon; metadata:service http;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where event.type == "start" and
      network.transport == "tcp" and
      network.direction == "inbound" and
      http.request.method != null ]
  [ http where http.request.headers != null and
      http.response.status_code >= 200 and
      http.response.status_code < 300 ]

Splunk SPL Query

index=web sourcetype=fastify OR sourcetype=nodejs
| eval hdr=lower(_raw)
| where (match(hdr,"propertynames") OR match(hdr,"enum") OR match(hdr,"const"))
    AND (match(hdr,"x-forwarded-") OR match(hdr,"x-original-") OR match(hdr,"x-override-") OR match(hdr,"x-admin-"))
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, host, uri, status
| where count > 0
| `comment("CVE-2026-107832 - suspected Fastify header validation bypass; correlates header-restriction telemetry with forbidden header presence")`

Wazuh OSSEC Rule

<group name="web,fastify,cve-2026-107832,">
  <rule id="100732" level="5">
    <decoded_as>json</decoded_as>
    <field name="http.request.headers">x-forwarded-|x-original-|x-override-|x-admin-|x-real-</field>
    <description>CVE-2026-107832: Potentially forbidden header present on Fastify request (possible schema validation bypass)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100733" level="3">
    <if_sid>100732</if_sid>
    <field name="http.response.status_code">^2\d\d$</field>
    <description>CVE-2026-107832: Forbidden header reached Fastify route handler with 2xx response</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: the NVD description explicitly states the issue "is fixed in fastify 5.12.6," but no patch source was corroborated by the tracked data pipeline, so confidence is recorded as 0/4 and the fix version is treated as vendor-stated rather than independently verified.

1. Immediate mitigations.

   • Declare all header names in route schemas in lowercase. Writing enum/const header names in all-lowercase form ensures they match the already-lowercased incoming header and restores the intended allow-list/deny-list behavior. This is the only applicable workaround per the description.
   • Where feasible, enforce header restrictions outside the route schema (for example, at a reverse proxy or application middleware) rather than relying solely on propertyNames schema validation.
   • Audit routes for any schema using propertyNames with enum or const header names written in non-lowercase casing, and treat those headers as unenforced until corrected.

2. Patch / upgrade steps.

   • Upgrade Fastify to 5.12.6 or later. The vendor description states the issue is fixed in 5.12.6 and that there is no workaround other than upgrading (beyond the lowercase-declaration mitigation above).
   • Verify the installed version via the project's dependency manifest and lockfile, and re-run schema-based tests after upgrading.

3. Long-term hardening.

   • Standardize lowercase header naming conventions in all route schemas and lint for non-lowercase header literals in CI.
   • Add regression tests asserting that intended-forbidden headers are rejected, covering both lowercase and canonical-cased schema declarations.
   • Incorporate dependency-version monitoring to track Fastify security advisories and ensure timely upgrades.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107832
• Fastify project: https://github.com/fastify/fastify
• Fastify security policy / advisories: https://github.com/fastify/fastify/security/advisories
• CWE-178 — Improper Handling of Case Sensitivity: https://cwe.mitre.org/data/definitions/178.html
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-107832 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-107832 as of this report. It is not listed in CISA KEV, no EPSS score has been published by FIRST.org, and no public PoC or Nuclei template exists.