fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.

A security vulnerability exists in Fastify versions before 5.12.2 related to incomplete HTTP header name normalization. The framework lowercases header names in route schemas but fails to apply this transformation to trigger and dependent names inside JSON Schema Draft 7 'dependencies' keywords. Because Node.js stores request header names in lowercase, conditional header dependencies never match, causing presence assertions to be silently skipped. This allows an unauthenticated remote client to send a privilege-activating header while omitting the required authentication header, effectively bypassing conditional security checks. The vulnerability can lead to unauthorized access to privileged functionality. No authentication is required to exploit this flaw remotely. Users are advised to upgrade to Fastify 5.12.2 or later to remediate the issue.