CVE-2026-84428

Executive Summary

CVE-2026-84428 is a case-normalization flaw (CWE-178) in the Fastify web framework affecting versions before 5.12.2. When Fastify compiles a route's header schema, it lowercases header names to honor HTTP's case-insensitive header semantics, but this transformation omits the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node.js stores incoming request header names in lowercase, a canonical-case dependency never matches, so conditional assertions such as "require an authentication header whenever a privileged-mode header is present" are silently skipped. An unauthenticated remote client can activate a privileged code branch while omitting the header the dependency was meant to require, bypassing the conditional check with high integrity impact.

Technical Analysis

HTTP header field names are case-insensitive, and Node.js normalizes incoming request headers to lowercase before exposing them to application code. Fastify compensates for this by lowercasing the properties keys and the root-level required array within a route's header schema before compilation, ensuring that schemas written in mixed or canonical case still match the lowercased runtime header names.

The flaw is that this normalization is incomplete: it does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Under Draft 7, dependencies expresses conditional constraints — if the property named by trigger is present (or, in the schema-form variant, validates against a subschema), then the property or subschema named by dependent must also be satisfied. When a developer writes a dependency such as requiring an authentication header whenever a privileged-mode header is present, the trigger/dependent identifiers remain in canonical case while the actual request headers are lowercased by Node. The names therefore never match, and the presence assertion is silently skipped rather than enforced.

The result is a fail-open validation gap: the route still compiles successfully and normal header validation continues to work, but the conditional security constraint that ties a privileged-mode header to a required authentication header is effectively dead code. An unauthenticated remote client can send the header that activates a privileged branch while omitting the header the dependency was intended to require, bypassing the conditional check (CWE-178 — Improper Handling of Case Sensitivity).

Key characteristics:

• Attack vector: network (AV:N), no privileges (PR:N), no user interaction (UI:N).
• Scope unchanged (S:U); confidentiality impact none (C:N); integrity impact high (I:H); availability none (A:N).
• CVSS 3.1 base score: 7.5 (HIGH).
• The vulnerability affects authorization-style gating implemented via header schema dependencies, not general header validation.

Because the affected code path is a schema-compilation/normalization routine rather than a specific route, the exposure depends entirely on which deployed routes use header dependencies for conditional security logic. Applications that gate privileged behavior on header presence — for example, a privileged-mode or admin header paired with an authentication header — are the primary at-risk population.

Exploitation Scenarios

No public PoC is documented; the following chain is inferred from the vulnerability class (improper handling of case sensitivity in schema normalization) and the NVD description. It uses only the schema keyword names and concepts stated in that description.

1. Reconnaissance / target identification: An attacker identifies a Fastify application running a version before 5.12.2 (e.g., via response header/banner fingerprinting or Shodan queries such as product:Fastify). The attacker maps routes and looks for functionality whose behavior toggles based on the presence of a specific header — the "privileged-mode header" referenced in the advisory.

2. Triggering the flaw class: The attacker sends requests that include the header which activates a privileged branch. Because the trigger name in the dependencies keyword was not lowercased during schema compilation, it fails to match Node's lowercased request header name. The dependent requirement — the authentication header the dependency was meant to enforce whenever the privileged-mode header is present — is never evaluated.

3. Payload / execution method: The attacker simply omits the header that the skipped dependency was meant to require (the authentication header). The presence assertion is silently bypassed, and the conditional check that should have rejected the request never fires. No special encoding, injection, or malformed payload is required — the attack is the absence of a required header combined with the presence of the trigger header.

4. Post-exploitation impact: The request proceeds down the privileged code branch without satisfying the intended conditional constraint. Given the CVSS integrity rating (I:H), the attacker can influence application state or behavior through the privileged path that should have been gated by the omitted header. Confidentiality is not directly rated (C:N) and availability is unaffected (A:N), scoping the primary impact to unauthorized activation of privileged functionality.

Important caveat: Successful exploitation is contingent on the target application actually using the dependencies keyword with canonical-case trigger/dependent names in a header schema for security-relevant gating. If no route uses that pattern, the flaw is latent and not exploitable on that deployment.

Impact Assessment

The vulnerability is remotely reachable and requires no authentication or user interaction, making it attractive for opportunistic scanning and targeted abuse of header-gated endpoints. The score of 7.5 (HIGH) is driven by network reachability (AV:N), low complexity (AC:L), and high integrity impact (I:H).

Blast radius is determined by deployment topology rather than the library in isolation:

• Applications exposing Fastify routes to the internet that gate privileged-mode behavior on header presence are directly exposed.
• Multi-tenant or internal administrative APIs using header-based conditional schemas may permit unauthorized state changes within the privileged branch.
• Confidentiality is rated none (C:N), so direct data disclosure is not the described impact; the primary risk is unauthorized activation/manipulation of privileged functionality (integrity).

Because Fastify is a widely deployed Node.js framework, the affected population is potentially large, but actual exploitability is conditional on the presence of the specific schema pattern. There is no evidence of CISA KEV listing, and EPSS is 0.00298 (22.5th percentile), indicating low near-term exploitation likelihood at the time of writing.

Detection Guidance

Sigma Rule

title: Fastify Header Schema Dependency Bypass Attempt (CVE-2026-84428)
id: 8f3c1a2e-84428-4b1e-9c7a-fastifycve
status: experimental
description: Detects requests to Fastify applications that set a privileged-mode header without the authentication header, potentially bypassing JSON Schema Draft 7 dependencies normalization (CWE-178).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84428
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_privileged:
    cs-method: '*'
    cs-uri-stem: '*'
    cs-headers|contains: 'x-privileged-mode'
  selection_missing_auth:
    cs-headers|not|contains: 'authorization'
  condition: selection_privileged and selection_missing_auth
falsepositives:
  - Legitimate internal callers aware of the specific header gating
  - Health checks or scanners probing privileged headers
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.84428

YARA Rule

rule CVE_2026_84428_Fastify_Dependencies_Normalization
{
    meta:
        description = "Detects Fastify source/config referencing header schema dependencies that may be affected by case-normalization bypass (CVE-2026-84428)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84428"
        date = "2026-01-01"
        severity = "high"

    strings:
        $dep = "dependencies"
        $trig = "trigger"
        $depend = "dependent"
        $fastify = "fastify" nocase
        $req = "required"

    condition:
        $fastify and $dep and ($trig or $depend) and $req
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84428 Fastify Header Schema Dependency Bypass Attempt"; flow:to_server,established; http.header_names; content:"|0d 0a|X-Privileged-Mode"; nocase; http.header_names; content:!"|0d 0a|Authorization"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-84428; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84428; sid:2026844280; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http" and
      http.request.headers contains "x-privileged-mode" ]
  [ network where network.protocol == "http" and
      not http.request.headers contains "authorization" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=fastify
| eval hdr=lower(_raw)
| where (match(hdr, "x-privileged-mode") OR match(hdr, "privileged")) AND NOT match(hdr, "authorization:")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, dest_host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,fastify,cve-2026-84428,">
  <rule id="202684428" level="10">
    <if_sid>31100</if_sid>
    <regex>X-Privileged-Mode|privileged-mode</regex>
    <description>CVE-2026-84428: Request sets privileged-mode header possibly without required authentication header - Fastify dependency bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84428,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix; NVD and OSV both identify the remediation version). Vendor fix field is not separately documented (N/A).

1. Immediate mitigations (if immediate upgrade is not possible):

   • Avoid relying on JSON Schema Draft 7 dependencies with canonical-case trigger/dependent names for security gating. Where feasible, author trigger and dependent identifiers in all-lowercase form so they match Node's lowercased request header names.
   • Replace header-dependencies-based conditional security checks with explicit application-level validation that reads the lowercased header map directly.
   • Front header-gated privileged routes with a reverse proxy or gateway that independently enforces the authentication-header requirement.
   • Restrict network access to privileged-mode endpoints via allowlisting where operationally possible.

2. Patch / upgrade steps:

   • Upgrade Fastify to version 5.12.2 or later.
   • Update lockfiles and rebuild container images; verify the runtime resolution pins fastify >= 5.12.2.
   • Re-run the application's schema-compilation/validation tests to confirm the route header schemas now honor the dependencies constraint.

3. Long-term hardening:

   • Treat schema normalization for case-insensitive identifiers as a security-relevant operation; add unit tests asserting that conditional (dependencies) constraints fire under lowercase inputs.
   • Adopt defense-in-depth: never rely solely on schema-level presence checks for authorization; enforce authentication/authorization in dedicated middleware.
   • Maintain a dependency inventory (SBOM) and subscribe to Fastify and OSV advisories to catch similar normalization-class defects early.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-84428
• OSV — Fastify advisory entry for CVE-2026-84428 (OSV package: fastify)
• Fastify project — official releases / changelog (upgrade target 5.12.2)
• CWE-178 — Improper Handling of Case Sensitivity: https://cwe.mitre.org/data/definitions/178.html
• CISA KEV Catalog — not listed (NO) as of report date; monitor for future addition

Threat actor campaigns / exploit-in-the-wild evidence: None confirmed. No Nuclei template and no public exploit code are documented; PoC status is Public at the advisory/description level (the CVE description is publicly available). EPSS 0.00298 (22.5th percentile) suggests low near-term exploitation activity at the time of writing.