Fastify implements case‑insensitive handling of HTTP headers by lowercasing header names in a route's schema, but its conversion is incomplete. The properties keys and the root‑level required array are lowercased, yet the names used inside the JSON Schema Draft 7 dependencies keyword remain unchanged. Because Node stores incoming header names in lowercase, a dependency that requires, for example, an authentication header whenever a privileged‑mode header is present never matches, and the requisite header check is silently omitted. An attacker can therefore send a request containing the privileged header while omitting the intended authentication header, allowing the server to treat the request as authenticated and to execute code in privileged mode.

Vendors impacted include fastify:fastify. The issue applies to all fastify releases prior to version 5.12.2, as newer releases have addressed the header normalization bug.

The CVSS score of 7.5 reflects a high severity vulnerability that enables an unauthenticated remote client to gain elevated privileges by bypassing authentication logic. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector involves a remote client crafting request headers that trigger the privileged branch while omitting the required authentication header; this bypass can be achieved without any special local access or privileged execution.