Improper Validation of Unsafe Equivalence in Input Affecting fastify package, versions <5.12.2

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input due to incomplete schema case normalization in lib/validation.js when compiling header schemas. An attacker can bypass schema-enforced header dependencies by sending canonical-cased header names in a request while omitting the dependent header the schema is meant to require. Because Node.js stores request headers in lowercase, Fastify’s shallow normalization missed dependencies and nested subschemas, so assertions such as requiring X-Admin-Token when X-Admin is present never matched the incoming request headers. This lets a remote client reach privileged header-gated routes or actions without supplying the full set of headers the application intended to enforce.

Workarounds

• Inline the header schema instead of referencing it with an external $ref, so header names can be case-normalized and case-insensitive assertions like required and dependencies still apply.

• GitHub Commit v5.12.2
• Maintainer's Advisory
• Red Hat Bugzilla Bug