chore(deps): update dependency fastify to v5.12.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fastify (source)	5.12.1 → 5.12.5

---

fastify vulnerable to header validation bypass via incomplete schema case normalization

CVE-2026-84428 / GHSA-9q9j-q6p8-xq58

More information

Details

Impact

Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7 dependencies keyword (its trigger keys and dependent property names) or names in nested subschemas. As a result, a header schema that uses dependencies to require one header when another is present (for example X-Admin requiring X-Admin-Token) never matches the lowercased request headers, so the dependency assertion is silently skipped. An unauthenticated remote client can send the header that activates a privileged path while omitting the header the dependency was meant to require, bypassing a schema-enforced security control. The header schema is idiomatic, valid JSON Schema Draft 7, and no custom validator, malformed request, or misconfiguration is required.

Patches

Header-schema names are now normalized across all schema positions (properties, required, dependencies, dependentRequired, dependentSchemas, and nested subschemas). Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release. Header schemas referenced through an external shared $ref (registered with addSchema) are not reached by this normalization and now emit an FSTSEC002 startup warning; inline the header schema to keep case-insensitive assertions in effect.

Workarounds

If upgrading is not immediately possible, write header-schema names in lowercase so the dependencies and other case-sensitive assertions match Node's lowercased request headers, or enforce the cross-header requirement in an onRequest or preValidation hook instead of the schema.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-9q9j-q6p8-xq58
• https://nvd.nist.gov/vuln/detail/CVE-2026-84428
• https://github.com/fastify/fastify/commit/179619c8e99d54924309b9933402151ef9af37e0
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-9q9j-q6p8-xq58

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to request validation bypass via skipped boolean false schemas

CVE-2026-84469 / GHSA-hwr6-493r-vm6h

More information

Details

Impact

Fastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, but because false is falsy, a route that set body, querystring, params, or headers to false had that part left uncompiled: no validator was attached and the request reached the handler. An application that used false as a deny-all schema to make a route unreachable was therefore fully bypassed, and an unauthenticated remote client could reach the handler with any input. The same applied to the documented query alias for querystring. This is a complete bypass rather than a weak-schema issue, since false is the strongest JSON Schema assertion and must always fail.

Patches

Request-part schemas are now selected by an explicit presence check rather than truthiness, so a boolean false (or true) schema is compiled and enforced, including through the query alias. Patched in fastify 5.12.2. The fix is also included in the 6.0.0 release.

Workarounds

If upgrading is not immediately possible, express a deny-all request schema with an always-failing object schema instead of the boolean false (for example { "not": {} }), or reject the request in an onRequest hook.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• https://nvd.nist.gov/vuln/detail/CVE-2026-84469
• https://github.com/fastify/fastify/commit/7de6e81697778f9f41bd327a3b1c5c9a0d9637b4
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-hwr6-493r-vm6h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

CVE-2026-76169 / GHSA-p68q-wchp-6fh7

More information

Details

Impact

Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler(). When the request method has no route in the main router, a malformed request target reaches Fastify's internal not-found router before URL decoding and is dispatched through a single shared handler pointer, regardless of prefix and without the normal request lifecycle. An unauthenticated request to a public prefix can therefore reach an authentication-protected not-found handler registered under a different prefix and receive its full response, breaking prefix encapsulation and bypassing the authentication hook. Applications whose private or tenant fallbacks return protected data from a not-found handler are affected.

Patches

Patched in fastify 5.12.2. Malformed URLs are now routed through the configured onBadUrl and onMaxParamLength handlers so they fail closed before any application not-found handler runs, and the shared not-found handler pointer has been removed.

Workarounds

Reject malformed request targets before they reach the application, for example at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data. A global onRequest authentication hook does not mitigate this, because the malformed-URL path skips it.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7
• https://nvd.nist.gov/vuln/detail/CVE-2026-76169
• https://github.com/fastify/fastify/commit/93c239a380f3f2778bb7565fcdf777e91cfe1fbc
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-p68q-wchp-6fh7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to request body replacement via an async validation result collision

CVE-2026-84504 / GHSA-667r-xxjv-c9mm

More information

Details

Impact

Fastify runs a route's validator and, for a result shaped like { value, error }, unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers (for example Joi). A JSON Schema $async validator, however, resolves with the validated data itself, so Fastify applied the same unwrapping to it. If a request part validated by an $async schema contains a value property, Fastify replaced the whole request part with that nested value before the handler ran, so a value or error property in the payload was attacker-controlled. An application that dispatches operations from the validated request body could then act on data that never satisfied the route schema, leading to unauthorized state changes or disclosure. Reaching the vulnerable path requires the route to use an $async request schema.

Patches

Fastify no longer treats an asynchronous validation result as a { value, error } wrapper: an async validator's resolved value is used only to determine pass or fail, and it can no longer replace the request part or inject an error. The synchronous custom-compiler contract is unchanged. Patched in fastify 5.12.2 and 6.0.0.

Workarounds

If upgrading is not immediately possible, avoid $async request schemas, or perform the security-sensitive check in an onRequest or preHandler hook rather than relying on the schema-validated request part. Custom async validator compilers should signal failure by throwing (rejecting) rather than returning an { error } object.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
• https://nvd.nist.gov/vuln/detail/CVE-2026-84504
• https://github.com/fastify/fastify/commit/f02d8d4ab1ab208f10819c4dc213595b06497833
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.2
• https://github.com/advisories/GHSA-667r-xxjv-c9mm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

CVE-2026-92081 / GHSA-4mh8-r7rc-xpvc

More information

Details

Impact

fastify crashes with an uncaught ERR_HTTP2_INVALID_CONNECTION_HEADERS exception when a route that registers a response trailer via reply.trailer() is served over HTTP/2. Fastify unconditionally adds the Transfer-Encoding: chunked header when a trailer is set, which is forbidden on HTTP/2, so Node.js throws while serializing the response headers. The exception is not caught and becomes an uncaughtException, terminating the Node.js process.

One unauthenticated HTTP/2 request to any route that uses trailers is enough to crash the server, dropping all in-flight requests, and the request can be repeated to keep the process down. Applications are affected only when HTTP/2 is enabled (http2: true) and at least one route registers a trailer. HTTP/1.x responses are not affected.

Patches

Upgrade to fastify 5.12.5 or later.

Workarounds

Avoid registering response trailers with reply.trailer() on routes served over HTTP/2 until upgrading.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/fastify/fastify/security/advisories/GHSA-4mh8-r7rc-xpvc
• https://nvd.nist.gov/vuln/detail/CVE-2026-92081
• https://github.com/fastify/fastify/issues/6574
• https://github.com/fastify/fastify/commit/ad06a4c3fe8a944a904f38068249b18b8f552e90
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/releases/tag/v5.12.5
• https://github.com/advisories/GHSA-4mh8-r7rc-xpvc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify (fastify)

v5.12.5

Compare Source

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @​github-actions[bot] in #​7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @​github-actions[bot] in #​7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Compare Source

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.3

Compare Source

v5.12.2

Compare Source

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in #​6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in #​7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1371ca0b-b99a-4f07-ad82-050359bb8dc9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Benchmark results

Comparing with 9fa2967

• Dependency count: 1,018 (no change)
• Package size: 381 MB ⬇️ 0.01% decrease vs. 9fa2967
• Number of ts-expect-error directives: 331 (no change)

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/netlify-cli@8547

commit: db63d69