CVE-2026-84504 in Fastify
Summary
by MITRE • 09/04/2026
fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Fastify versions prior to 5.12.2 represents a critical logic flaw within the framework's request validation pipeline, specifically involving the interaction between Ajv async validators and custom validator compilers. In standard HTTP application development using Fastify, incoming requests are validated against JSON schemas defined by route handlers to ensure data integrity and security boundaries. The core issue arises when an asynchronous validator resolves successfully; instead of returning a standardized result object that includes metadata such as errors or valid flags, the framework incorrectly treats the resolved value itself as the final protocol result for custom validators. This deviation from expected behavior creates a pathway where internal processing logic can be manipulated by external input, bypassing the intended separation between validation outcomes and data transformation.
From a technical perspective, this flaw manifests when an authenticated user submits a request that conforms to the route's schema but includes a specific property named value at the root level of the JSON body. Because Fastify interprets the resolved object from the async validator as the direct result protocol, it erroneously replaces the entire validated request body with the content of this value property before passing control to the application handler. Consequently, the handler receives an object that differs significantly from the one originally submitted and validated against the schema. This discrepancy means that while the initial payload may have passed security checks based on its structure, the actual data processed by the business logic is entirely different, effectively allowing attackers to inject arbitrary objects into the execution context under the guise of a valid request.
The operational impact of this vulnerability is severe, primarily because it enables unauthorized state changes and potential data disclosure for authenticated low-privilege users. By controlling the value property in their requests, an attacker can substitute the expected parameters with malicious payloads that trigger administrative functions or access restricted resources without proper authorization checks. Since the route schema validated the original structure but not the substituted content, standard role-based access controls tied to specific endpoints may be circumvented. This leads to a breakdown in security assumptions where data integrity is compromised, allowing attackers to perform actions such as modifying user profiles, accessing sensitive records, or executing privileged operations that were never intended for their account level.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-862 Missing Authorization, as the framework fails to properly validate the transformed data against security policies after the substitution occurs. Furthermore, it relates to ATT&CK technique T1548 Abuse Configuration, where an attacker exploits a misconfiguration in application logic to escalate privileges or bypass controls. The root cause lies in the incorrect handling of asynchronous validation results, which violates the principle of least privilege by granting excessive influence over request body content based on a specific property name rather than strict schema adherence.
To mitigate this risk, organizations must upgrade Fastify to version 5.12.2 or later immediately, as these versions correct the logic error in how async validator results are processed and ensure that custom validators adhere strictly to the expected result protocol without substituting request bodies based on property names. In addition to upgrading, developers should implement strict input sanitization and avoid relying solely on schema validation for security decisions when complex data transformations occur. Monitoring logs for unusual patterns of requests containing root-level value properties can also aid in detecting potential exploitation attempts during the transition period before patching is fully deployed across all environments.