Description

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T11:17:19.317Z",
  "pubdate": "2026-09-04T11:17:19.317Z",
  "executiveSummary": "A security vulnerability exists in Fastify versions prior to 5.12.2 involving improper normalization of HTTP header names within JSON Schema dependencies.\nThe flaw stems from an incomplete transformation process where header names are lowercased in the schema compilation stage, specifically failing to account for trigger and dependent names defined within the JSON Schema Draft 7 'dependencies' keyword.\nBecause Node.js canonicalizes all incoming HTTP header names to lowercase, the mismatch between the schema-defined dependency (which may contain mixed-case strings) and the actual headers results in the validation logic being silently skipped.\nThis creates an authentication bypass vector, as remote, unauthenticated attackers can trigger privileged code paths that rely on conditional header requirements. By omitting a mandatory dependency header while supplying the trigger header, an attacker can bypass security constraints. The vulnerability is highly exploitable, requiring no specific credentials, and necessitates immediate upgrading to the remediated version to restore intended schema validation integrity.",
  "technicalDetails": "The vulnerability resides in the Fastify header schema compilation logic, which attempts to enforce case-insensitivity by converting header keys and the 'required' array elements to lowercase. This approach assumes that all schema-level checks will correctly align with the lowercase nature of Node.js HTTP request headers.\nThe root cause is a deficiency in the transformation logic applied to JSON Schema Draft 7 'dependencies'. While the framework correctly normalizes properties keys and the top-level 'required' list, it fails to perform a recursive or structural transformation on the keys and values nested within the 'dependencies' keyword. Consequently, if a schema defines a dependency such as {'Privileged-Mode': ['Required-Auth-Header']}, the normalization process neglects to lowercase these strings.\nDuring the request lifecycle, when Fastify evaluates the headers against the schema, the underlying validator compares the lowercase Node.js request headers against the un-normalized schema strings. Because 'privileged-mode' (the normalized header) does not match 'Privileged-Mode' (the schema key), the dependency validation logic fails to trigger.\nThe attack flow proceeds as follows: 1) An attacker identifies a route protected by a 'dependencies' schema constraint, where a 'privileged' header mandates an 'authentication' header. 2) The attacker crafts a request containing only the 'privileged' header in lowercase. 3) Fastify processes the request, normalizing the incoming header to lowercase. 4) The schema validator attempts to check dependencies but finds no match for the original, mixed-case schema requirement due to the missing normalization step. 5) The validator incorrectly determines that the dependency condition is not applicable or met, effectively skipping the requirement check. 6) The application logic proceeds as if the authentication header was present or not required, allowing unauthorized access to privileged functionality.\nThis behavior represents a failure in constraint enforcement, leading to a bypass of security controls. Since the vulnerability is located at the schema validation layer, it affects all routes utilizing 'dependencies' for header validation. The impact is significant, as it permits attackers to interact with internal route branches that were explicitly intended to be gated by specific header combinations."
}