npm/fastify CVE-2026-107832: low 3.7
fastify is vulnerable to header validation bypass via case-sensitive propertyNames
Action: Upgrade fastify to 5.12.6 or later.
npm i fastify@5.12.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.12.2 | 5.12.6 | - |
Fixed versions
| 5.12.6 |
Sources
- osv: GHSA-389g-gv7q-r4x8
- https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8
- https://nvd.nist.gov/vuln/detail/CVE-2026-107832
- https://github.com/fastify/fastify/pull/7104
- https://github.com/fastify/fastify/commit/3241fbd2f10a8ca1503533726836b53b6e8775a2
- https://github.com/fastify/fastify/commit/35c32375731c111439682b2f9e6e0baed2694269
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify
- https://github.com/fastify/fastify/releases/tag/v5.12.6
CVE-2026-107832 · published · modified · JSON