{"schema":"vulnpedia.research/1","cve":"CVE-2026-107832","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8","tags":["WEB","vendor-reference"],"source":"mitre","sourceId":"openjs","modified":"2026-10-13T13:23:24.217Z","origins":[{"source":"mitre","sourceId":"openjs","modified":"2026-10-13T13:23:24.217Z","url":"https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8"},{"source":"nvd","sourceId":"CVE-2026-107832","modified":"2026-10-15T20:38:04.303","url":"https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8"},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://github.com/fastify/fastify/security/advisories/GHSA-389g-gv7q-r4x8"}]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["WEB","vendor-reference"],"source":"mitre","sourceId":"openjs","modified":"2026-10-13T13:23:24.217Z","origins":[{"source":"mitre","sourceId":"openjs","modified":"2026-10-13T13:23:24.217Z","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"nvd","sourceId":"CVE-2026-107832","modified":"2026-10-15T20:38:04.303","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://cna.openjsf.org/security-advisories.html"}]},{"url":"https://osv.dev/vulnerability/GHSA-389g-gv7q-r4x8","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","origins":[{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://osv.dev/vulnerability/GHSA-389g-gv7q-r4x8"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://osv.dev/vulnerability/GHSA-389g-gv7q-r4x8"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107832","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","origins":[{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107832"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107832"},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107832"}]},{"url":"https://github.com/fastify/fastify/pull/7104","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","origins":[{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://github.com/fastify/fastify/pull/7104"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://github.com/fastify/fastify/pull/7104"}]},{"url":"https://github.com/fastify/fastify/commit/3241fbd2f10a8ca1503533726836b53b6e8775a2","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","origins":[{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://github.com/fastify/fastify/commit/3241fbd2f10a8ca1503533726836b53b6e8775a2"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://github.com/fastify/fastify/commit/3241fbd2f10a8ca1503533726836b53b6e8775a2"}]},{"url":"https://github.com/fastify/fastify/commit/35c32375731c111439682b2f9e6e0baed2694269","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","origins":[{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://github.com/fastify/fastify/commit/35c32375731c111439682b2f9e6e0baed2694269"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://github.com/fastify/fastify/commit/35c32375731c111439682b2f9e6e0baed2694269"}]},{"url":"https://github.com/fastify/fastify","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","origins":[{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://github.com/fastify/fastify"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://github.com/fastify/fastify"}]},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.6","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","origins":[{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://github.com/fastify/fastify/releases/tag/v5.12.6"},{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://github.com/fastify/fastify/releases/tag/v5.12.6"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107832","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-107832"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550519","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550519"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107832","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-107832"}]},{"source":"euvd","sourceId":"EUVD-2026-98697","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98697","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-98697","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98697"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","url":"https://osv.dev/vulnerability/GHSA-389g-gv7q-r4x8","ecosystem":"npm","name":"fastify","purl":"pkg:npm/fastify","ranges":[{"type":"SEMVER","events":[{"introduced":"5.12.2"},{"fixed":"5.12.6"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-389g-gv7q-r4x8/GHSA-389g-gv7q-r4x8.json"},"modified":"2026-10-22T16:45:04.287484964Z","origins":[{"source":"ghsa","sourceId":"GHSA-389g-gv7q-r4x8","modified":"2026-10-22T16:45:04.287484964Z","url":"https://osv.dev/vulnerability/GHSA-389g-gv7q-r4x8"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9","product":"rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-cuda-rhel9@sha256:e0fbb896811ab54d183e23612030072b946674824bad697bf2b3f68362651662?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9","product":"rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9","product":"rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-rocm-rhel9@sha256:8fe5203e86917e5f829bd64b831cad31536d23a213b4bfe31e652577ad0faf2e?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9","product":"rhelai3/disk-image-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/disk-image-cuda-rhel9@sha256:9d807c5381e81734b6303669421b265aea1eca54a18ca577d453508ffde1770c?repository_url=registry.redhat.io/rhelai3/disk-image-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-core-bff-rhel9","product":"rhoai/odh-core-bff-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-core-bff-rhel9@sha256:e683d11de1a782b2a796c99eccb5dfb3b908e721210ba87c2e06768f1fa8745d?repository_url=registry.redhat.io/rhoai/odh-core-bff-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-operator-rhel9","product":"rhoai/odh-dashboard-operator-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-dashboard-operator-rhel9@sha256:0f0a7c4386c958d30b1be5dcbec6a98ae5cabbdfb93570849991912cf318ae99?repository_url=registry.redhat.io/rhoai/odh-dashboard-operator-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-dashboard-rhel9","product":"rhoai/odh-dashboard-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-dashboard-rhel9@sha256:3598eb7647c5b3489db1eeb00db8e842a0b7208205718e817689fedf0fe194f2?repository_url=registry.redhat.io/rhoai/odh-dashboard-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-agent-ops-rhel9","product":"rhoai/odh-mod-arch-agent-ops-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-mod-arch-agent-ops-rhel9@sha256:bf5e5b308f9f167fe21c2ac0f8f7dd65af47bbd7d0c3396b66fbe62620d853b4?repository_url=registry.redhat.io/rhoai/odh-mod-arch-agent-ops-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-automl-rhel9","product":"rhoai/odh-mod-arch-automl-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-mod-arch-automl-rhel9@sha256:5cfd714e9a5fa61ed867771fbbb2b22e5a79ad05fd6940fa80dab09dfa43aef6?repository_url=registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-autorag-rhel9","product":"rhoai/odh-mod-arch-autorag-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-mod-arch-autorag-rhel9@sha256:ae98ca5f53502bd9f40f74ad9f834676200cf65773f139829d13a69aed8a0de9?repository_url=registry.redhat.io/rhoai/odh-mod-arch-autorag-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-eval-hub-rhel9","product":"rhoai/odh-mod-arch-eval-hub-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-mod-arch-eval-hub-rhel9@sha256:147f35cb1319e707ca9c3d68be2c6eb026bde915b8ffee9e22b003403b8e2896?repository_url=registry.redhat.io/rhoai/odh-mod-arch-eval-hub-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-gen-ai-rhel9","product":"rhoai/odh-mod-arch-gen-ai-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-mod-arch-gen-ai-rhel9@sha256:aa5a8ab4112bf9d6a356740103d97497f7b76071ab979eeb3d6a86322f928e31?repository_url=registry.redhat.io/rhoai/odh-mod-arch-gen-ai-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-maas-rhel9","product":"rhoai/odh-mod-arch-maas-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-mod-arch-maas-rhel9@sha256:f46aa6658c532ac9e8fcb3feeb5d764d9ee0eaf9e8af0563e87ef3998b5e426e?repository_url=registry.redhat.io/rhoai/odh-mod-arch-maas-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-mlflow-rhel9","product":"rhoai/odh-mod-arch-mlflow-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-mod-arch-mlflow-rhel9@sha256:59d595add75040b8408c9536c0b7fb422f437b5ae359c0324b54cb1e1718c995?repository_url=registry.redhat.io/rhoai/odh-mod-arch-mlflow-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-mod-arch-model-registry-rhel9","product":"rhoai/odh-mod-arch-model-registry-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-mod-arch-model-registry-rhel9@sha256:7051b4bc1631d4be790d6ad2b1c8cb579090dfaeb39e17ba91037b6cb456a8c7?repository_url=registry.redhat.io/rhoai/odh-mod-arch-model-registry-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]},{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json","productId":"red_hat_openshift_dev_spaces:devspaces/dashboard-rhel9","product":"devspaces/dashboard-rhel9 as a component of Red Hat OpenShift Dev Spaces","status":"known_affected","remediations":[{"category":"workaround","details":"Applications can work around this issue by declaring header names in lowercase in the enum or const values of the route schema's propertyNames subschema, so the declared names match the lowercased incoming headers and the allow-list or deny-list validation applies as intended. The upstream fix is available in fastify 5.12.6 and later; for the affected Red Hat products the fix is currently deferred."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/dashboard-rhel9@sha256:4da408d8b9dd1368285e5f289dd89ab2f86f069e50d88b1241e997b88edbf7ed?repository_url=registry.redhat.io/devspaces/dashboard-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-107832","modified":"2026-10-16T09:49:53+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107832.json"}]}],"vendorCoverage":{"total":16,"shown":16,"omitted":0,"source":"redhat"}}