Fastify up to 5.12.1 input validation

Summaryinfo

A vulnerability, which was classified as problematic, was found in Fastify up to 5.12.1. This affects an unknown function. The manipulation results in input validation. This vulnerability is identified as CVE-2026-84469. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in Fastify up to 5.12.1. Affected is some unknown functionality. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity. CVE summarizes:

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-84469 since 09/01/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 5.12.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-70989). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Fastify

Version

• 5.12.0
• 5.12.1

Website

• Product: https://github.com/fastify/fastify/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion