# CVE-2026-107832: fastify is vulnerable to header validation bypass via case-sensitive propertyNames

Source: https://junglewise.ai/threats/cve-2026-107832-fastify-is-a-fast-and-low-overhead-web-framework-for-node-js-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13  
License: CC BY 4.0 with a link back

CVE-2026-107832 · Severity: low · CVSS 3.7 · Published 2026-10-13

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a restricted header passes validation and reaches the route handler. An attacker can therefore bypass a case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or later. There is no workaround other than upgrading, though applications can declare header names in lowercase to avoid the mismatch.

Technologies: [fastify (npm)](https://junglewise.ai/threats/technologies/fastify). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107832 being exploited in the wild.

**How severe is CVE-2026-107832?** Low severity, with a CVSS score of 3.7, published 13 October 2026.

**Which products and versions are affected?** fastify (npm) >= 5.12.2, < 5.12.6, SEMVER:introduced=5.12.2,fixed=5.12.6.

**Is there a fix for CVE-2026-107832?** Yes. fastify (npm): upgrade to 5.12.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-107832?** Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fastify (npm): upgrade to 5.12.6 or later

  ```sh
  npm install fastify@5.12.6
  ```


## Affected products

- fastify (npm) >= 5.12.2, < 5.12.6, SEMVER:introduced=5.12.2,fixed=5.12.6

## Identifiers

- CVE-2026-107832
- GHSA-389g-gv7q-r4x8

## Related threats

- [Fastify denial of service via unhandled exception on HTTP/2 trailer responses](https://junglewise.ai/threats/cve-2026-92081-fastify-denial-of-service-via-unhandled-exception-on-http-2)
- [Fastify header validation bypass via incomplete schema case normalization](https://junglewise.ai/threats/cve-2026-84428-fastify-header-validation-bypass-via-incomplete-schema-case)
- [Fastify request body replacement via async validation result collision](https://junglewise.ai/threats/cve-2026-84504-fastify-request-body-replacement-via-async-validation-result)
- [Fastify request validation bypass via skipped boolean false schemas](https://junglewise.ai/threats/cve-2026-84469-fastify-request-validation-bypass-via-skipped-boolean-false)
- [Fastify authentication bypass via malformed URLs in encapsulated handlers](https://junglewise.ai/threats/cve-2026-76169-fastify-authentication-bypass-via-malformed-urls-in-encapsulated)