The vulnerability resides in the header‑name parsing logic of the Fastify web framework. In versions 5.12.2 to 5.12.5, the routine that converts declared header names to lowercase fails to process enum or const names nested inside a propertyNames schema. Consequently, a header allow‑list or deny‑list defined with canonical casing never matches the automatically lowercased incoming header, permitting a forbidden header to pass validation. The result is that an attacker can inject a header that the application logic was intended to block, compromising the integrity of request handling.

Node.js applications that use the fastify:fastify framework, specifically versions 5.12.2, 5.12.3, 5.12.4 and 5.12.5, are impacted. Any route that relies on Fastify’s schema‑based header validation will be affected. Upgrading to 5.12.6 or later resolves the issue.

The CVSS score of 3.7 denotes low severity, and the EPSS score is unavailable, indicating a modest exploit probability. The vulnerability is not presently listed in CISA’s KEV catalog. Attackers would need to send crafted HTTP requests containing the mismatched headers; the flaw is accessible over the network, so the attack vector is remote. While the risk is limited to request‑handling integrity, a successful bypass could undermine application logic that depends on strict header filtering.