Fastify CVE-2026-84428

Exploitation requires both a Fastify instance running a version before 5.12.2 AND at least one route whose header validation schema uses the JSON Schema Draft 7 dependencies keyword with trigger or dependent header names specified in mixed or canonical case. Routes that enforce header requirements exclusively through the required array or property-level minLength/pattern constraints are not vulnerable to this specific bypass. The CVSS PR:N confirms the attacker needs no prior credentials or session; AV:N and AC:L confirm the exploit is directly network-reachable with no configuration prerequisite on the attacker's side. The sole limiting factor for any given deployment is whether the dependencies keyword is actually used in a header schema - organizations that do not use this schema pattern in their Fastify route definitions are not exposed.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately characterizes a remotely exploitable, unauthenticated integrity bypass with no complexity barrier - even a mid-sized municipal IT team in gdynia deploying Fastify-based APIs with header-driven access control should treat this as urgent if the dependencies keyword is in use. Real-world impact is entirely conditional on whether a given application uses the JSON Schema dependencies keyword within header schemas; routes that rely only on required arrays or property-level validation are unaffected by this specific bypass path. No EPSS data was supplied, and the CVE carries no CISA KEV listing, indicating no confirmed in-the-wild exploitation at time of analysis. The 'Denial Of Service' tag in the input metadata is incorrect - the CVSS A:N and the description confirm this is a schema-enforcement bypass yielding integrity impact, not a denial-of-service condition. The attack surface is inherently low-friction: exploitation requires only standard HTTP request construction with no memory corruption or timing dependency, so if applications do use the affected schema pattern, practical exploitation is straightforward once the bypass is understood.

An attacker targeting a Fastify API endpoint protected by a dependencies-based header rule - for example, requiring an x-auth-token header whenever x-admin-mode is present - sends a crafted HTTP request that includes x-admin-mode: true while omitting x-auth-token. The schema compiler's failure to lowercase the dependency trigger means the validation engine never evaluates the conditional requirement, the request passes schema validation without error, and the application's privileged code path executes. No public exploit code is available, but the bypass requires only standard HTTP request construction.