CVE-2026-84428

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Published

Sep 4, 2026, 10:24:27 AM UTC

Updated

Sep 4, 2026, 11:17:19 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 25, 2026

A flaw was found in fastify. Due to incomplete case normalization of HTTP header names within a route's header schema, specifically within the JSON Schema Draft 7 dependencies keyword, an unauthenticated remote attacker can bypass intended conditional checks. This allows the attacker to send headers that activate privileged functionality without providing the required authentication headers, leading to an authorization bypass. fastify: fastify: Header validation bypass via incomplete schema case normalization This flaw in fastify allows an unauthenticated remote attacker to bypass header validation checks. Due to incomplete case normalization of HTTP header names, an attacker can send specially crafted headers to activate privileged application branches, potentially leading to unauthorized access to sensitive functionality within applications utilizing fastify. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.