CVE-2026-107832

Name of the Vulnerable Software and Affected Versions fastify versions 5.12.2 through 5.12.5

Description A routine used to lowercase header names declared in a route schema fails to lowercase enum or const header names nested within a propertyNames subschema. This causes header allow-lists or deny-lists using canonical casing to fail to match incoming lowercased headers, allowing restricted headers to bypass validation and reach the route handler. An attacker can exploit this to smuggle forbidden headers, compromising the integrity of request handling.

Recommendations Upgrade to version 5.12.6 or later. Declare header names in lowercase to avoid the mismatch.