CyberRota Analysis
AI-GeneratedFastify versions prior to 5.12.2 are vulnerable due to an incomplete implementation of case-insensitivity for HTTP header names, allowing unauthenticated remote clients to bypass required authentication checks. This flaw can lead to unauthorized access to privileged routes, posing a significant security risk. Organizations using affected Fastify versions should prioritize upgrading to 5.12.2 or later to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.
Related CVEs
Other vulnerabilities affecting the same vendor(s)