[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fastify (source)	5.12.5 → 5.12.6

---

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

CVE-2026-107832 / GHSA-389g-gv7q-r4x8

More information

Details

Impact

Fastify lowercases header names in a headers schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names held in a propertyNames subschema's enum and const. A header-name deny-list written in the canonical header case, such as propertyNames: { not: { enum: ['X-Debug-Override'] } }, therefore never matches the lowercased request headers, and the forbidden header reaches the handler. Any application that uses a propertyNames deny-list or allow-list to constrain request header names does not get the constraint it expects. The same rule written in lowercase works, and the not: { required: [...] } form is unaffected, so this is a gap in the built-in normalization rather than a wrong schema. This is an incomplete fix of CVE-2026-84428 (GHSA-9q9j-q6p8-xq58), whose normalization covered header names used as property keys but not those used as values inside propertyNames.

Patches

Users should upgrade to fastify 5.12.6 or later, which lowercases header names held in enum and const inside a propertyNames subschema so they match the lowercased request headers. Header-name constraints that cannot be normalized automatically, regular expressions (propertyNames pattern and patternProperties keys) and a $ref used inside propertyNames, are documented and, for the $ref case, warned at startup (FSTSEC003). Author those to match the lowercased request headers.

Workarounds

Write the propertyNames header-name constraint in lowercase (for example enum: ['x-debug-override']), or enforce the header check in an onRequest or preValidation hook instead of the schema.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8
• https://nvd.nist.gov/vuln/detail/CVE-2026-107832
• https://github.com/fastify/fastify/pull/7104
• https://github.com/fastify/fastify/commit/3241fbd2f10a8ca1503533726836b53b6e8775a2
• https://github.com/fastify/fastify/commit/35c32375731c111439682b2f9e6e0baed2694269
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.6
• https://github.com/advisories/GHSA-389g-gv7q-r4x8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify (fastify)

v5.12.6

Compare Source

⚠️ Security Release

• Fix for GHSA-389g-gv7q-r4x8

What's Changed

• [Backport 5.x] types: restrict route lookup methods by @​github-actions[bot] in #​7048
• [Backport 5.x] perf: decode string bodies once instead of per chunk by @​github-actions[bot] in #​7053
• [Backport 5.x] perf: avoid resetting the level of request child loggers by @​github-actions[bot] in #​7058
• [Backport 5.x] fix: resolve reply.mediaType from raw response headers by @​github-actions[bot] in #​7067
• [Backport 5.x] perf: use a FIFO cache for parsed content-types by @​github-actions[bot] in #​7072
• [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/const by @​mcollina in #​7104
• [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of storing it by @​github-actions[bot] in #​7087
• [Backport 5.x] fix: remove error when HTTP QUERY request has empty body by @​github-actions[bot] in #​7060
• [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 by @​github-actions[bot] in #​7094

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6996fcda-b7b3-4106-b880-e78b74f6f83c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Benchmark results

Comparing with f1632d5

• Dependency count: 968 (no change)
• Package size: 337 MB ⬆️ 0.01% increase vs. f1632d5
• Number of ts-expect-error directives: 280 (no change)

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/netlify-cli@8656

commit: 832b028

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.