Unauthorized Data Modification in Fastify by Low-Privilege Users

CVE-2026-84504

What is CVE-2026-84504?

Fastify versions preceding 5.12.2 have a critical flaw where the framework mishandles validated request data. When an authenticated user with low privileges forms a request that adheres to a defined route schema but includes a 'value' property at the root, Fastify incorrectly replaces the complete request body with this property. This issue allows these users to manipulate nested data structures, potentially altering the intended behavior of the application and leading to unapproved data disclosure and unexpected state changes. Upgrading to Fastify 5.12.2 or later is essential to mitigate these risks.

References