CVE-2026-107832
Description
A flaw was found in fastify. The framework's route schema validation fails to properly normalize the casing of header names declared within nested property name schemas. A remote attacker can exploit this vulnerability by submitting requests with restricted headers, bypassing header allow-lists or deny-lists configured with canonical casing. Consequently, forbidden headers can reach route handlers and undermine the integrity of request processing.
Statement
A LOW severity vulnerability was found in fastify, a Node.js web framework used by components of Red Hat OpenShift AI and Red Hat OpenShift Dev Spaces. fastify's route schema validation does not normalize the casing of header names declared as enum or const values nested inside a propertyNames subschema. As a result, a header allow-list or deny-list written with canonical (non-lowercase) casing never matches the lowercased incoming header name, so a restricted header passes validation and reaches the route handler. A remote, unauthenticated attacker can exploit this by sending requests containing restricted headers to an application that applies such case-sensitive header validation rules in a non-default route configuration; successful exploitation has a low integrity impact on request processing, with no impact on confidentiality or availability. This matches the upstream assessment, which also rates the flaw LOW severity (CVSS 3.1 score 3.7). The affected Red Hat products are recorded as AFFECTED with the resolution deferred because Red Hat does not file trackers for LOW severity flaws; the residual risk is limited to applications that rely on case-sensitive header allow-lists or deny-lists within nested property-name schemas.
Mitigation
Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Improperly handled case sensitive data can lead to several possible consequences, including: - case-insensitive passwords reducing the size of the key space, making brute force attacks easier - bypassing filters or access controls using alternate names - multiple interpretation errors using alternate names.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
