CVE-2026-84428: fastify vulnerable to header validation bypass via incomplete schema case normalization
Impact
Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7 dependencies keyword (its trigger keys and dependent property names) or names in nested subschemas. As a result, a header schema that uses dependencies to require one header when another is present (for example X-Admin requiring X-Admin-Token) never matches the lowercased request headers, so the dependency assertion is silently skipped. An unauthenticated remote client can send the header that activates a privileged path while omitting the header the dependency was meant to require, bypassing a schema-enforced security control. The header schema is idiomatic, valid JSON Schema Draft 7, and no custom validator, malformed request, or misconfiguration is required.
Patches
Header-schema names are now normalized across all schema positions (properties, required, dependencies, dependentRequired, dependentSchemas, and nested subschemas). Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release. Header schemas referenced through an external shared $ref (registered with addSchema) are not reached by this normalization and now emit an FSTSEC002 startup warning; inline the header schema to keep case-insensitive assertions in effect.
Workarounds
If upgrading is not immediately possible, write header-schema names in lowercase so the dependencies and other case-sensitive assertions match Node's lowercased request headers, or enforce the cross-header requirement in an onRequest or preValidation hook instead of the schema.
Other sources
fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fastifyto a version that resolves this vulnerability.Fixed in 5.12.2 - Upgrade
Upgrade
fastifyto a version that resolves this vulnerability.Fixed in 5.12.2 - Configuration
Write header-schema names in lowercase so dependencies and other case-sensitive assertions match Node.js lowercased request headers; alternatively enforce the cross-header requirement in an onRequest or preValidation hook.
Fastify header schema Header-schema property, required, dependency, and nested-subschema names = lowercase - Configuration
Inline header schemas instead of referencing them through an external shared $ref registered with addSchema, to keep case-insensitive assertions in effect and avoid the FSTSEC002 startup warning.
Fastify header schema External shared $ref header schema = inline
Event History
Frequently Asked Questions
Which deployments are exposed?
Fastify versions before 5.12.2 are exposed when a route's header schema uses the JSON Schema Draft 7 dependencies keyword to conditionally require one header based on another, and the dependency trigger or dependent header name is not normalized to lowercase.
What does an attacker need to exploit this?
An unauthenticated remote client needs to be able to reach a route with the affected header-schema dependency. They can send the header that enables a privileged branch while omitting the authentication header that the dependency was intended to require.
How can I identify affected routes?
Review route header schemas for dependencies that express requirements between headers, especially rules requiring authentication when a privileged-mode header is present. Check whether the trigger and dependent header names within dependencies use canonical or mixed case rather than lowercase.
What is the remediation?
Upgrade Fastify to version 5.12.2 or later.