fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-84428 is a header validation bypass vulnerability affecting Fastify versions before 5.12.2. The flaw stems from incomplete case-normalization of HTTP header names during route schema compilation. While Fastify lowercases header property keys and root-level required arrays, it fails to normalize trigger and dependent names within JSON Schema Draft 7 dependencies keywords. Since Node.js stores request headers in lowercase, attackers can craft requests using canonical-case header names that bypass schema validation rules intended to enforce required authentication headers or other critical security controls. This vulnerability affects any Fastify application using the dependencies keyword in header schemas to implement conditional validation logic, potentially allowing unauthorized access or security policy circumvention.
While MITRE ATT&CK techniques are not directly mapped to this CVE, Casky's security skills running Claude AI with extended reasoning would identify this as an application-level input validation defect (CWE-178: Improper Normalization). A practitioner using Casky would observe detection patterns aligned with reconnaissance and initial access stages—specifically, requests with mismatched header case attempting to bypass authentication or authorization checks. The platform's 754 security skills would flag anomalous header usage patterns that deviate from normalized schemas, surfacing inconsistencies between declared validation logic and actual request processing. Practitioners would see findings highlighting schema validation gaps where headers required by dependencies keywords could be silently ignored due to case-sensitivity mismatches, enabling potential credential bypass or policy evasion attempts that conventional header inspection might miss.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-84428. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation