Validation Bypass in Fastify Affects Application Security

CVE-2026-84469

What is CVE-2026-84469?

Fastify versions before 5.12.2 improperly handle request schema compilation based on JavaScript truthiness. According to JSON Schema Draft 7, the boolean value false is a valid schema intended to reject all instances. When this value is set for body, querystring, params, or headers schema to prevent any input, Fastify fails to compile a corresponding validator. As a result, the route handler becomes accessible to any request, undermining intended security measures. This flaw can lead to unauthorized state changes or allow the execution of operations that should be disabled. To mitigate this risk, users are urged to update to Fastify version 5.12.2 or later.

References