Detections
Analytics
SCA: security update for fastify (GHSA-389g-gv7q-r4x8)
low Tenable Self-Hosted Container Security Plugin ID 476851
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the
routine that lowercases header names declared in a route schema does not lowercase the enum or const
header names nested inside a propertyNames subschema. As a result, a header allow-list or deny-list
written with canonical (non-lowercase) casing never matches the incoming lowercased header, so a
restricted header passes validation and reaches the route handler. An attacker can therefore bypass a
case-sensitive header validation rule and smuggle a forbidden header past the schema, affecting the
integrity of request handling. The issue is fixed in fastify 5.12.6, and users should upgrade to 5.12.6 or
later. There is no workaround other than upgrading, though applications can declare header names in
lowercase to avoid the mismatch. (CVE-2026-107832)
Solution
Update the fastify library and its related packages to version 5.12.6 or later.See Also
Plugin Details
Severity: Low
ID: 476851
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/22/2026
Updated: 10/22/2026
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2026-107832
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/22/2026
Vulnerability Publication Date: 10/13/2026
Reference Information
CVE: CVE-2026-107832
cwe: CWE-178