CVE-2026-84428

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.2

Description An issue exists in how HTTP header names are handled during the compilation of a route's header schema. The software attempts to implement the case-insensitive nature of HTTP headers by lowercasing property keys and the root-level required array, but it fails to lowercase the trigger and dependent names within the JSON Schema Draft 7 dependencies keyword. Since Node.js stores request header names in lowercase, dependencies using canonical-case names never match, causing presence assertions to be silently skipped. This allows an unauthenticated remote client to send a header that activates a privileged branch while omitting a required header, thereby bypassing conditional checks.

Recommendations Upgrade to fastify version 5.12.2 or later.