Fastify EUVD-2026-98697

Exploitable only when a fastify 5.12.2-5.12.5 application defines a route schema that validates headers via a propertyNames subschema whose enum or const header names are written in canonical (non-lowercase) casing, functioning as a header allow-list or deny-list. The lowercasing routine skips these nested enum/const names, so the rule never matches the already-lowercased incoming header. Limiting factors: applications that declare header names in lowercase are not affected; apps that do not use header allow/deny-list schemas at all are not affected; impact is confined to smuggling a single restricted header past validation (integrity only, no code execution, data disclosure, or availability loss). Default configurations without such case-sensitive header schemas are not vulnerable, which is why AC:H applies.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) yields only 3.7 (Low), and every signal agrees: impact is limited to integrity (I:L, with C:N and A:N), and AC:H reflects that exploitation depends on a specific, non-default application configuration - a route schema whose header allow/deny-list is written in canonical (non-lowercase) casing inside a propertyNames enum/const. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is no signal conflict to reconcile between exploitation feeds; the only notable inconsistency is in the metadata - the 'Information Disclosure' tag contradicts the CVSS impact profile (C:N, I:L) and the description, which explicitly states the flaw affects 'the integrity of request handling,' not confidentiality. Net: a real but narrow correctness/validation-bypass bug that matters only to apps using case-sensitive header schemas on fastify 5.12.2-5.12.5; it does not warrant emergency patching but should be rolled into normal dependency maintenance.

An application on fastify 5.12.2-5.12.5 defines a route header schema that restricts or forbids a specific header (e.g. 'X-Internal-Auth' or 'X-Forwarded-For') using propertyNames with canonical casing. A remote unauthenticated attacker sends the forbidden header, which is lowercased on arrival and therefore never matches the non-lowercased rule, so it passes validation and reaches the handler. No public exploit code is identified at time of analysis.