[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fastify (source)	5.12.5 → 5.12.6

---

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

CVE-2026-107832 / GHSA-389g-gv7q-r4x8

More information

Details

Impact

Fastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header case, such as propertyNames: { not: { enum: ['X-Debug-Override'] } }, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a propertyNames deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the not: { required: [...] } form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 (GHSA-9q9j-q6p8-xq58), whose normalization covered header names used as property keys but not those used as values inside propertyNames.

Patches

Users should upgrade to fastify 5.12.6 or later, which lowercases header names held in enum and const inside a propertyNames subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (propertyNames pattern and patternProperties keys) and a $ref used inside propertyNames, are documented and, for the $ref case, warned at startup (FSTSEC003). Author those to match the lowercased request headers.

Workarounds

Write the propertyNames header-name constraint in lowercase (for example enum: ['x-debug-override']), or enforce the header check in an onRequest or preValidation hook instead of the schema.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8
• https://nvd.nist.gov/vuln/detail/CVE-2026-107832
• https://github.com/fastify/fastify/pull/7104
• https://github.com/fastify/fastify/commit/3241fbd2f10a8ca1503533726836b53b6e8775a2
• https://github.com/fastify/fastify/commit/35c32375731c111439682b2f9e6e0baed2694269
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.6
• https://github.com/advisories/GHSA-389g-gv7q-r4x8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify (fastify)

v5.12.6

Compare Source

⚠️ Security Release

• Fix for GHSA-389g-gv7q-r4x8

What's Changed

• [Backport 5.x] types: restrict route lookup methods by @​github-actions[bot] in #​7048
• [Backport 5.x] perf: decode string bodies once instead of per chunk by @​github-actions[bot] in #​7053
• [Backport 5.x] perf: avoid resetting the level of request child loggers by @​github-actions[bot] in #​7058
• [Backport 5.x] fix: resolve reply.mediaType from raw response headers by @​github-actions[bot] in #​7067
• [Backport 5.x] perf: use a FIFO cache for parsed content-types by @​github-actions[bot] in #​7072
• [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/const by @​mcollina in #​7104
• [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of storing it by @​github-actions[bot] in #​7087
• [Backport 5.x] fix: remove error when HTTP QUERY request has empty body by @​github-actions[bot] in #​7060
• [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 by @​github-actions[bot] in #​7094

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.