fastify 6.0.0-alpha.4 → 6.0.0-alpha.6

package/lib/errors.js

@@ -2,6 +2,12 @@
 
 const createError = require('@fastify/error')
 
+// Errors created when Fastify rejects an invalid request. They have no stack
+// trace, see "Errors In Input Data" in docs/Reference/Errors.md.
+function createRequestError (code, message, statusCode, Base = Error) {
+  return createError(code, message, statusCode, Base, false)
+}
+
 const codes = {
   /**
    * Basic
@@ -47,7 +53,7 @@ const codes = {
     500,
     TypeError
   ),
-  FST_ERR_VALIDATION: createError(
+  FST_ERR_VALIDATION: createRequestError(
     'FST_ERR_VALIDATION',
     '%s',
     400
@@ -102,29 +108,29 @@ const codes = {
     500,
     TypeError
   ),
-  FST_ERR_CTP_BODY_TOO_LARGE: createError(
+  FST_ERR_CTP_BODY_TOO_LARGE: createRequestError(
     'FST_ERR_CTP_BODY_TOO_LARGE',
     'Request body is too large',
     413,
     RangeError
   ),
-  FST_ERR_CTP_INVALID_MEDIA_TYPE: createError(
+  FST_ERR_CTP_INVALID_MEDIA_TYPE: createRequestError(
     'FST_ERR_CTP_INVALID_MEDIA_TYPE',
     'Unsupported Media Type',
     415
   ),
-  FST_ERR_CTP_INVALID_CONTENT_LENGTH: createError(
+  FST_ERR_CTP_INVALID_CONTENT_LENGTH: createRequestError(
     'FST_ERR_CTP_INVALID_CONTENT_LENGTH',
     'Request body size did not match Content-Length',
     400,
     RangeError
   ),
-  FST_ERR_CTP_EMPTY_JSON_BODY: createError(
+  FST_ERR_CTP_EMPTY_JSON_BODY: createRequestError(
     'FST_ERR_CTP_EMPTY_JSON_BODY',
     "Body cannot be empty when content-type is set to 'application/json'",
     400
   ),
-  FST_ERR_CTP_INVALID_JSON_BODY: createError(
+  FST_ERR_CTP_INVALID_JSON_BODY: createRequestError(
     'FST_ERR_CTP_INVALID_JSON_BODY',
     "Body is not valid JSON but content-type is set to 'application/json'",
     400
@@ -365,13 +371,13 @@ const codes = {
     'FST_ERR_DUPLICATED_ROUTE',
     "Method '%s' already declared for route '%s'"
   ),
-  FST_ERR_BAD_URL: createError(
+  FST_ERR_BAD_URL: createRequestError(
     'FST_ERR_BAD_URL',
     "'%s' is not a valid url component",
     400,
     URIError
   ),
-  FST_ERR_MAX_PARAM_LENGTH: createError(
+  FST_ERR_MAX_PARAM_LENGTH: createRequestError(
     'FST_ERR_MAX_PARAM_LENGTH',
     "'%s' is exceeding the max param length",
     414,
@@ -461,16 +467,11 @@ const codes = {
     500,
     TypeError
   ),
-  FST_ERR_ROUTE_MISSING_CONTENT_TYPE: createError(
+  FST_ERR_ROUTE_MISSING_CONTENT_TYPE: createRequestError(
     'FST_ERR_ROUTE_MISSING_CONTENT_TYPE',
     "Method '%s' must provide a 'Content-Type' header.",
     400
   ),
-  FST_ERR_ROUTE_MISSING_CONTENT: createError(
-    'FST_ERR_ROUTE_MISSING_CONTENT',
-    "Method '%s' must provide a request body.",
-    400
-  ),
 
   /**
    *  again listen when close server

package/lib/handle-request.js

@@ -6,8 +6,7 @@ const { validate: validateSchema } = require('./validation')
 const { preValidationHookRunner, preHandlerHookRunner } = require('./hooks')
 const {
   FST_ERR_CTP_INVALID_MEDIA_TYPE,
-  FST_ERR_ROUTE_MISSING_CONTENT_TYPE,
-  FST_ERR_ROUTE_MISSING_CONTENT
+  FST_ERR_ROUTE_MISSING_CONTENT_TYPE
 } = require('./errors')
 const { setErrorStatusCode } = require('./error-status')
 const {
@@ -51,20 +50,15 @@ function handleRequest (err, request, reply) {
         reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT_TYPE(method))
         return
       }
-
-      if (isEmptyBody(headers)) {
-        // https://datatracker.ietf.org/doc/html/rfc10008#section-2
-        // Servers MUST fail the request if the Content-Type request field
-        // ([HTTP], Section 8.3) is missing or is inconsistent with the
-        // request content.
-        reply[kReplyIsError] = true
-        reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT(method))
-        return
-      }
     }
 
     if (ctHeader === undefined) {
-      if (isEmptyBody(headers)) {
+      const contentLength = headers['content-length']
+      const transferEncoding = headers['transfer-encoding']
+      const isEmptyBody = transferEncoding === undefined &&
+        (contentLength === undefined || contentLength === '0')
+
+      if (isEmptyBody) {
         // Request has no body to parse
         handler(request, reply)
         return
@@ -109,13 +103,6 @@ function handler (request, reply) {
   }
 }
 
-function isEmptyBody (headers) {
-  const contentLength = headers['content-length']
-  const transferEncoding = headers['transfer-encoding']
-  return transferEncoding === undefined &&
-    (contentLength === undefined || contentLength === '0')
-}
-
 function preValidationCallback (err, request, reply) {
   if (reply.sent === true) return
 

package/lib/reply.js

@@ -95,7 +95,7 @@ Object.defineProperties(Reply.prototype, {
   },
   mediaType: {
     get () {
-      const contentTypeHeader = this[kReplyHeaders]['content-type']
+      const contentTypeHeader = this.getHeader('content-type')
       return ContentType.from(contentTypeHeader).mediaType
     }
   },
@@ -284,6 +284,10 @@ Reply.prototype.header = function (key, value = '') {
     } else {
       this[kReplyHeaders][key].push(value)
     }
+  } else if (key === 'set-cookie' && Array.isArray(value)) {
+    // Copy the array: later calls push into the stored one, and the caller's
+    // array (often a module-level constant) must not grow across requests.
+    this[kReplyHeaders][key] = value.slice()
   } else {
     this[kReplyHeaders][key] = value
   }
@@ -370,7 +374,7 @@ Reply.prototype.getSerializationFunction = function (schemaOrStatus, contentType
   return serialize
 }
 
-Reply.prototype.compileSerializationSchema = function (schema, httpStatus = null, contentType = null) {
+Reply.prototype.compileSerializationSchema = function (schema, httpStatus, contentType) {
   const { request } = this
   const { method, url } = request
 
@@ -839,9 +843,6 @@ function sendStream (payload, res, reply) {
   let sourceOpen = true
   let errorLogged = false
 
-  // set trailer when stream ended
-  sendStreamTrailer(payload, res, reply)
-
   eos(payload, { readable: true, writable: false }, function (err) {
     sourceOpen = false
     if (err != null) {
@@ -854,8 +855,12 @@ function sendStream (payload, res, reply) {
       } else {
         onErrorHook(reply, err)
       }
+      return
+    }
+    // eos fires even for a stream that already ended
+    if (reply[kReplyTrailers] !== null) {
+      sendTrailer(null, res, reply)
     }
-    // there is nothing to do if there is not an error
   })
 
   eos(res, function (err) {
@@ -887,7 +892,12 @@ function sendStream (payload, res, reply) {
   } else {
     reply.log.warn('response will send, but you shouldn\'t use res.writeHead in stream mode')
   }
-  payload.pipe(res)
+  // trailers set: the eos listener above ends the response, not pipe
+  if (reply[kReplyTrailers] !== null) {
+    payload.pipe(res, { end: false })
+  } else {
+    payload.pipe(res)
+  }
 }
 
 function sendTrailer (payload, res, reply) {
@@ -947,11 +957,6 @@ function sendTrailer (payload, res, reply) {
   if (skipped) res.end(null, null, null) // avoid ArgumentsAdaptorTrampoline from V8
 }
 
-function sendStreamTrailer (payload, res, reply) {
-  if (reply[kReplyTrailers] === null) return
-  payload.on('end', () => sendTrailer(null, res, reply))
-}
-
 function onErrorHook (reply, error, cb) {
   if (reply[kRouteContext].onError !== null && !reply[kReplyNextErrorHandler]) {
     reply[kReplyIsRunningOnErrorHook] = true
@@ -1079,7 +1084,7 @@ function notFound (reply) {
  * @returns {string} the serialized payload
  */
 function serialize (context, data, statusCode, contentType) {
-  const fnSerialize = getSchemaSerializer(context, statusCode, contentType)
+  const fnSerialize = getSchemaSerializer(context, statusCode, contentType, { failClosed: true })
   if (fnSerialize) {
     return fnSerialize(data)
   }

package/lib/request.js

@@ -20,6 +20,8 @@ const { FST_ERR_REQ_INVALID_VALIDATION_INVOCATION, FST_ERR_DEC_UNDECLARED } = re
 const decorators = require('./decorate')
 const ContentType = require('./content-type')
 
+const PORT_REGEX = /(?<port>:\d+)$/
+
 const HTTP_PART_SYMBOL_MAP = {
   body: kSchemaBody,
   headers: kSchemaHeaders,
@@ -122,8 +124,10 @@ function buildRequestWithTrustProxy (R, trustProxy) {
     host: {
       get () {
         const socket = this.raw.socket
-        if (this.headers['x-forwarded-host'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
-          return getLastEntryInMultiHeaderValue(this.headers['x-forwarded-host'])
+        // The headers getter may allocate a new object, so read it once.
+        const headers = this.headers
+        if (headers['x-forwarded-host'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
+          return getLastEntryInMultiHeaderValue(headers['x-forwarded-host'])
         }
         /**
          * The last fallback supports the following cases:
@@ -131,14 +135,16 @@ function buildRequestWithTrustProxy (R, trustProxy) {
          * 2. HTTP/1.0 without a Host Header
          * 3. Headers schema that may remove the Host Header
          */
-        return this.headers.host ?? this.headers[':authority'] ?? ''
+        return headers.host ?? headers[':authority'] ?? ''
       }
     },
     protocol: {
       get () {
         const socket = this.raw.socket
-        if (this.headers['x-forwarded-proto'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
-          return getLastEntryInMultiHeaderValue(this.headers['x-forwarded-proto'])
+        // The headers getter may allocate a new object, so read it once.
+        const headers = this.headers
+        if (headers['x-forwarded-proto'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
+          return getLastEntryInMultiHeaderValue(headers['x-forwarded-proto'])
         }
         if (this.socket) {
           return this.socket.encrypted ? 'https' : 'http'
@@ -259,8 +265,7 @@ Object.defineProperties(Request.prototype, {
   },
   port: {
     get () {
-      const portReg = /(?<port>:\d+)$/
-      const matches = portReg.exec(this.host)
+      const matches = PORT_REGEX.exec(this.host)
       if (matches === null || matches[1] === undefined) {
         return null
       }

package/lib/route.js

@@ -110,7 +110,10 @@ function buildRouting (options) {
       return503OnClosing = Object.hasOwn(options, 'return503OnClosing') ? options.return503OnClosing : true
       keepAliveConnections = fastifyArgs.keepAliveConnections
     },
-    routing: router.lookup.bind(router), // router func to find the right handler to call
+    // router func to find the right handler to call, not bound because
+    // router.compile() replaces router.lookup
+    routing: (req, res, done) => router.lookup(req, res, done),
+    compileRoutes: () => router.compile(),
     route, // configure a route in the fastify instance
     hasRoute,
     prepareRoute,
@@ -466,8 +469,12 @@ function buildRouting (options) {
       // the child logger creation altogether
       childLogger = logger
     } else {
-      const loggerOpts = {
-        level: context.logLevel
+      const loggerOpts = {}
+
+      // An empty level means "inherit". Passing it would make pino treat it
+      // as a level change and rebuild every log method of each request child.
+      if (context.logLevel) {
+        loggerOpts.level = context.logLevel
       }
 
       if (context.logSerializers) {
@@ -531,12 +538,35 @@ function buildRouting (options) {
       request[kRequestSignal] = ac
 
       request[kTimeoutTimer] = setTimeout(() => {
-        if (!reply.sent) {
-          const err = new FST_ERR_HANDLER_TIMEOUT(handlerTimeout, context.config?.url)
-          ac.abort(err)
+        // If the reply has already ended (or was hijacked) the response
+        // lifecycle is managed elsewhere and there is nothing left to do.
+        if (reply.sent === true) {
+          return
+        }
+
+        const err = new FST_ERR_HANDLER_TIMEOUT(handlerTimeout, context.config?.url)
+        ac.abort(err)
+
+        // Aborting runs any request.signal listener synchronously; if a
+        // listener sent or hijacked the response, leave it intact rather than
+        // destroying it, which would reset the connection.
+        if (reply.sent === true) {
+          return
+        }
+
+        if (reply.raw.headersSent === true) {
+          // The response has already started transmitting, e.g. an active
+          // stream that has written its headers/body before the timeout.
+          // Sending an error response now would raise an uncaught
+          // ERR_HTTP_HEADERS_SENT and terminate the process, so abort the
+          // in-flight response instead.
           reply[kReplyIsError] = true
-          reply.send(err)
+          reply.raw.destroy(err)
+          return
         }
+
+        reply[kReplyIsError] = true
+        reply.send(err)
       }, handlerTimeout)
 
       const onAbort = () => {
@@ -674,6 +704,9 @@ function buildRouterOptions (options, defaultOptions) {
     }
   }
 
+  // compile is only accepted in routerOptions, not as a top-level option
+  routerOptions.compile ??= defaultInitOptions.routerOptions.compile
+
   return routerOptions
 }
 

package/lib/schemas.js

@@ -8,7 +8,8 @@ const {
   FST_ERR_SCH_MISSING_ID,
   FST_ERR_SCH_ALREADY_PRESENT,
   FST_ERR_SCH_DUPLICATE,
-  FST_ERR_SCH_CONTENT_MISSING_SCHEMA
+  FST_ERR_SCH_CONTENT_MISSING_SCHEMA,
+  FST_ERR_MISSING_CONTENTTYPE_SERIALIZATION_FN
 } = require('./errors')
 const ContentType = require('./content-type')
 
@@ -134,6 +135,40 @@ function generateFluentSchema (schema) {
   }
 }
 
+/**
+ * Resolve the right JSON Schema serialization function for a per-media-type
+ * (`content`) response schema map, given the response media type.
+ *
+ * @param {object} contentSchema the compiled per-content-type schema map
+ * @param {string} mediaType the response media type (lowercased)
+ * @param {string|number} statusCode the resolved http status key
+ * @param {boolean} failClosed whether to throw when no schema matches (used
+ *   for route response serialization) or return false (used by the error
+ *   handler, which falls back to the default error serializer)
+ * @returns {function|false} the serializer function, or false when no schema
+ *   applies and failClosed is false
+ */
+function getContentSerializer (contentSchema, mediaType, statusCode, failClosed) {
+  if (contentSchema[mediaType]) {
+    return contentSchema[mediaType]
+  }
+
+  // fallback to match all media-types
+  if (contentSchema['*/*']) {
+    return contentSchema['*/*']
+  }
+
+  // The response content-type is not declared in the route's content map. When
+  // serializing a route response, do not fall back to a raw JSON dump (which
+  // would bypass the response schema and expose every field); surface the
+  // misconfiguration instead.
+  if (failClosed) {
+    throw new FST_ERR_MISSING_CONTENTTYPE_SERIALIZATION_FN(statusCode, mediaType)
+  }
+
+  return false
+}
+
 /**
  * Search for the right JSON schema compiled function in the request context
  * setup by the route configuration `schema.response`.
@@ -142,11 +177,15 @@ function generateFluentSchema (schema) {
  * @param {object} context the request context
  * @param {number} statusCode the http status code
  * @param {string} [contentType] the reply content type
+ * @param {object} [opts] serialization options
+ * @param {boolean} [opts.failClosed] when true, throw when the response
+ *   content-type is not declared in the content map; otherwise return false
  * @returns {function|false} the right JSON Schema function to serialize
  * the reply or false if it is not set
  */
-function getSchemaSerializer (context, statusCode, contentType) {
+function getSchemaSerializer (context, statusCode, contentType, opts = {}) {
   const responseSchemaDef = context[kSchemaResponse]
+  const failClosed = opts.failClosed === true
   if (!responseSchemaDef) {
     return false
   }
@@ -154,16 +193,7 @@ function getSchemaSerializer (context, statusCode, contentType) {
     if (responseSchemaDef[statusCode].constructor === Object) {
       const ct = ContentType.from(contentType)
       if (ct.isValid) {
-        if (responseSchemaDef[statusCode][ct.mediaType]) {
-          return responseSchemaDef[statusCode][ct.mediaType]
-        }
-
-        // fallback to match all media-type
-        if (responseSchemaDef[statusCode]['*/*']) {
-          return responseSchemaDef[statusCode]['*/*']
-        }
-
-        return false
+        return getContentSerializer(responseSchemaDef[statusCode], ct.mediaType, statusCode, failClosed)
       }
     }
     return responseSchemaDef[statusCode]
@@ -173,16 +203,7 @@ function getSchemaSerializer (context, statusCode, contentType) {
     if (responseSchemaDef[fallbackStatusCode].constructor === Object) {
       const ct = ContentType.from(contentType)
       if (ct.isValid) {
-        if (responseSchemaDef[fallbackStatusCode][ct.mediaType]) {
-          return responseSchemaDef[fallbackStatusCode][ct.mediaType]
-        }
-
-        // fallback to match all media-type
-        if (responseSchemaDef[fallbackStatusCode]['*/*']) {
-          return responseSchemaDef[fallbackStatusCode]['*/*']
-        }
-
-        return false
+        return getContentSerializer(responseSchemaDef[fallbackStatusCode], ct.mediaType, fallbackStatusCode, failClosed)
       }
     }
 
@@ -192,16 +213,7 @@ function getSchemaSerializer (context, statusCode, contentType) {
     if (responseSchemaDef.default.constructor === Object) {
       const ct = ContentType.from(contentType)
       if (ct.isValid) {
-        if (responseSchemaDef.default[ct.mediaType]) {
-          return responseSchemaDef.default[ct.mediaType]
-        }
-
-        // fallback to match all media-type
-        if (responseSchemaDef.default['*/*']) {
-          return responseSchemaDef.default['*/*']
-        }
-
-        return false
+        return getContentSerializer(responseSchemaDef.default, ct.mediaType, 'default', failClosed)
       }
     }
 

package/lib/validation.js

@@ -13,7 +13,7 @@ const {
   FST_ERR_SCH_RESPONSE_SCHEMA_NOT_NESTED_2XX
 } = require('./errors')
 
-const { FSTWRN001, FSTSEC002 } = require('./warnings')
+const { FSTWRN001, FSTSEC002, FSTSEC003 } = require('./warnings')
 
 function compileSchemasForSerialization (context, compile) {
   if (!context.schema || !context.schema.response) {
@@ -70,9 +70,14 @@ function compileSchemasForSerialization (context, compile) {
 // reachable through `allOf`, `anyOf`, `oneOf`, `not`, `if`/`then`/`else`, local
 // `$ref` definitions (`definitions`/`$defs`), and the other standard subschema
 // containers. The input schema is never mutated: a new schema tree is returned.
-function lowerCaseHeadersSchema (schema) {
+//
+// A `propertyNames` subschema validates each header name itself, so values held
+// in `enum` and `const` (and in every subschema reachable from it) are header
+// names rather than header values. `insidePropertyNames` tracks that context so
+// those `enum`/`const` string values are lowercased there, and only there.
+function lowerCaseHeadersSchema (schema, insidePropertyNames = false) {
   if (Array.isArray(schema)) {
-    return schema.map(lowerCaseHeadersSchema)
+    return schema.map(item => lowerCaseHeadersSchema(item, insidePropertyNames))
   }
   if (schema === null || typeof schema !== 'object') {
     return schema
@@ -91,7 +96,7 @@ function lowerCaseHeadersSchema (schema) {
         }
         const normalized = {}
         for (const prop of Object.keys(value)) {
-          normalized[prop.toLowerCase()] = lowerCaseHeadersSchema(value[prop])
+          normalized[prop.toLowerCase()] = lowerCaseHeadersSchema(value[prop], insidePropertyNames)
         }
         result.properties = normalized
         break
@@ -112,7 +117,7 @@ function lowerCaseHeadersSchema (schema) {
           if (Array.isArray(depValue)) {
             normalized[dep.toLowerCase()] = depValue.map(name => name.toLowerCase())
           } else {
-            normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(depValue)
+            normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(depValue, insidePropertyNames)
           }
         }
         result.dependencies = normalized
@@ -125,7 +130,7 @@ function lowerCaseHeadersSchema (schema) {
         }
         const normalized = {}
         for (const dep of Object.keys(value)) {
-          normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(value[dep])
+          normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(value[dep], insidePropertyNames)
         }
         result.dependentSchemas = normalized
         break
@@ -158,12 +163,21 @@ function lowerCaseHeadersSchema (schema) {
       case 'unevaluatedItems':
       case 'unevaluatedProperties':
       case 'contains':
-      case 'propertyNames':
       case 'contentSchema':
-        result[key] = lowerCaseHeadersSchema(value)
+        result[key] = lowerCaseHeadersSchema(value, insidePropertyNames)
+        break
+      case 'propertyNames':
+        result[key] = lowerCaseHeadersSchema(value, true)
         break
       // Maps of subschemas whose keys are not header names (definition names,
       // regex patterns): keep the keys, normalize the subschema values.
+      //
+      // `patternProperties` keys are regular expressions matched against the
+      // already-lowercased header names and are left as-is: a regular expression
+      // cannot be safely lowercased. The same applies to a `propertyNames`
+      // `pattern`. A header-name pattern written in canonical case will not match
+      // the lowercased request headers, so it must be authored to match
+      // lowercase. See docs/Reference/Validation-and-Serialization.md.
       case 'definitions':
       case '$defs':
       case 'patternProperties': {
@@ -173,13 +187,23 @@ function lowerCaseHeadersSchema (schema) {
         }
         const normalized = {}
         for (const k of Object.keys(value)) {
-          normalized[k] = lowerCaseHeadersSchema(value[k])
+          normalized[k] = lowerCaseHeadersSchema(value[k], insidePropertyNames)
         }
         result[key] = normalized
         break
       }
       default:
-        result[key] = value
+        // Inside a `propertyNames` subschema, `enum` and `const` values are the
+        // candidate header names themselves, so they must be lowercased to match
+        // the lowercased request headers. Everywhere else these hold header
+        // *values* (or arbitrary constant data) and must be left untouched.
+        if (insidePropertyNames && key === 'enum' && Array.isArray(value)) {
+          result[key] = value.map(item => typeof item === 'string' ? item.toLowerCase() : item)
+        } else if (insidePropertyNames && key === 'const' && typeof value === 'string') {
+          result[key] = value.toLowerCase()
+        } else {
+          result[key] = value
+        }
     }
   }
 
@@ -217,6 +241,35 @@ function findExternalHeaderRef (schema) {
   return undefined
 }
 
+// A `$ref` reached inside a `propertyNames` subschema resolves to a definition
+// that is normalized in its own, non-`propertyNames` context, so header names
+// held in its `enum`/`const` keep their original case and a case-insensitive
+// deny-list or allow-list never matches the lowercased request headers. We
+// cannot safely normalize the referenced definition here because it may be
+// shared with value contexts, so we detect the reference and warn instead.
+// Returns the first local `$ref` found inside a `propertyNames` subschema, or
+// undefined.
+function findPropertyNamesRef (schema, insidePropertyNames = false) {
+  if (Array.isArray(schema)) {
+    for (const item of schema) {
+      const ref = findPropertyNamesRef(item, insidePropertyNames)
+      if (ref !== undefined) return ref
+    }
+    return undefined
+  }
+  if (schema === null || typeof schema !== 'object') {
+    return undefined
+  }
+  if (insidePropertyNames && typeof schema.$ref === 'string' && schema.$ref[0] === '#') {
+    return schema.$ref
+  }
+  for (const key of Object.keys(schema)) {
+    const ref = findPropertyNamesRef(schema[key], insidePropertyNames || key === 'propertyNames')
+    if (ref !== undefined) return ref
+  }
+  return undefined
+}
+
 function compileSchemasForValidation (context, compile, isCustom) {
   const { schema } = context
   if (!schema) {
@@ -246,6 +299,10 @@ function compileSchemasForValidation (context, compile, isCustom) {
       if (externalRef !== undefined) {
         FSTSEC002(method, url, externalRef)
       }
+      const propertyNamesRef = findPropertyNamesRef(headers)
+      if (propertyNamesRef !== undefined) {
+        FSTSEC003(method, url, propertyNamesRef)
+      }
       context[headersSchema] = compile({ schema: headersSchemaLowerCase, method, url, httpPart: 'headers' })
     }
   } else if (Object.hasOwn(schema, 'headers')) {

package/lib/warnings.js

@@ -7,6 +7,7 @@ const { createWarning } = require('process-warning')
  *   - FSTWRN001
  *   - FSTSEC001
  *   - FSTSEC002
+ *   - FSTSEC003
  *
  * Deprecation Codes FSTDEP001 - FSTDEP021 were used by v4 and MUST NOT be reused.
  *                             - FSTDEP022 - FSTDEP025 are used by v5 and MUST NOT be reused.
@@ -41,9 +42,17 @@ const FSTSEC002 = createWarning({
   unlimited: true
 })
 
+const FSTSEC003 = createWarning({
+  name: 'FastifySecurity',
+  code: 'FSTSEC003',
+  message: 'The headers schema for %s: %s uses a $ref (%s) inside propertyNames that is not case-normalized. Header names held in the referenced schema keep their original case and will not match the lowercased request headers, so a case-insensitive deny-list or allow-list on header names may not apply. Inline the propertyNames constraint instead of referencing it with a $ref.',
+  unlimited: true
+})
+
 module.exports = {
   FSTWRN001,
   FSTWRN003,
   FSTSEC001,
-  FSTSEC002
+  FSTSEC002,
+  FSTSEC003
 }