CVE-2026-84469
Received Received - Intake

Fastify Validation Bypass via False Schema in Pre-5.12.2

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
2026-09-04
NVD
CVE-2026-84469
EUVD
EUVD-2026-70989

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fastify fastify to 5.12.2 (exc)
fastify fastify From 5.12.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Fastify versions before 5.12.2 incorrectly handle JSON Schema Draft 7's boolean false value. When a route's schema is set to false to block all input, Fastify skips validation entirely instead of rejecting requests. This allows unauthenticated attackers to bypass intended access controls and send arbitrary input to route handlers.

Detection Guidance

To detect this vulnerability, check the installed Fastify version using: npm list fastify. If the version is below 5.12.2, the system is vulnerable. Additionally, inspect route configurations for schemas set to false in body, querystring, params, or headers.

Impact Analysis

Unauthenticated remote attackers can exploit this to reach route handlers that were meant to be inaccessible, potentially leading to unauthorized state changes, data modification, or execution of disabled operations. The impact is a complete validation bypass.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating integrity and access control requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient input validation and access controls.

Mitigation Strategies

Upgrade Fastify to version 5.12.2 or later immediately. If upgrading is not possible, replace false schemas with { "not": {} } or implement deny-all logic in an onRequest hook to block all requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84469. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart