Executive brief
Fastify is a web framework used to build Node.js-based REST APIs and web services. A vulnerability in header validation allows an unauthenticated attacker to bypass security checks that enforce conditional header requirements (such as requiring an authentication token when accessing privileged endpoints). An attacker can send privileged requests while omitting required authentication headers, potentially gaining unauthorized access to protected functionality.
Technical details
The vulnerability exists in Fastify's header schema normalization logic. Fastify lowercases header property names to match Node.js's lowercase storage of request headers, but the normalization was incomplete: it only lowercased top-level properties and the root required array, but failed to lowercase the JSON Schema Draft 7 dependencies keyword (trigger keys and dependent property names) and nested subschema names. As a result, dependency assertions that require one header when another is present never match the lowercased request headers, silently skipping the validation. An unauthenticated remote attacker can send a request with a privileged header while omitting a required dependent header, bypassing the schema-enforced security control. The attack requires no privileges, user interaction, or malformed requests. The fix normalizes header-schema names across all schema positions and is available in Fastify 5.12.2 and later.
Affected products
- OpenJS Foundation Fastify < 5.12.2
Timeline
- 2026-09-04: disclosed: CVE-2026-84428 published
- 2026-09-04: patched: Fastify 5.12.2 and 6.0.0 released with fix