fastify is vulnerable to header validation bypass via case-sensitive propertyNames

### Impact Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a `propertyNames` subschema's `enum` and `const`. A header-name deny-list written in the canonical header case, such as `propertyNames: { not: { enum: ['X-Debug-Override'] } }`, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a `propertyNames` deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the `not: { required: [...] }` form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 ([GHSA-9q9j-q6p8-xq58](https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58)), whose normalization covered header names used as property keys but not those used as values inside `propertyNames`. ### Patches Users should upgrade to fastify `5.12.6` or later, which lowercases header names held in `enum` and `const` inside a `propertyNames` subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (`propertyNames` `pattern` and `patternProperties` keys) and a `$ref` used inside `propertyNames`, are documented and, for the `$ref` case, warned at startup (`FSTSEC003`). Author those to match the lowercased request headers. ### Workarounds Write the `propertyNames` header-name constraint in lowercase (for example `enum: ['x-debug-override']`), or enforce the header check in an `onRequest` or `preValidation` hook instead of the schema.

Source published

22 Oct 2026 16:40:35 UTC

Source modified

22 Oct 2026 16:45:04 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Publisher rating · LOW