CVE-2026-84428

Fastify versions before 5.12.2 mishandle case when compiling a route's header schema: while it lowercases property keys and the root-level required array, it does not lowercase the trigger and dependent header names inside the JSON Schema Draft 7 'dependencies' keyword (CWE-178, improper handling of case sensitivity). Because Node.js stores incoming request header names in lowercase, a dependency written in canonical case, such as requiring an authentication header whenever a privileged-mode header is present, never matches, so the presence assertion is silently skipped. An unauthenticated remote attacker can exploit this by sending the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check (integrity impact only, per the CVSS score of 7.5). Any Fastify application that defines route-level header schemas using the 'dependencies' keyword with mixed-case header names is affected; applications not using that schema construct are not exposed. Exploitation is not currently observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS is about 0.3% (21st percentile).

What to do: Upgrade to fastify 5.12.2 or later. As an interim measure, audit route header schemas for 'dependencies' keywords whose trigger or dependent names are not lowercase and either write those names fully in lowercase (matching what Node stores) or enforce the required header in application code. Given no known public PoC, KEV listing, and low EPSS, there is no evidence of active exploitation, but patch promptly where the affected schema pattern gates authentication or privileged operations.