CVE-2026-84504
Received Received - Intake

Fastify Body Replacement via Ajv Async Validator

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
2026-09-04
NVD
CVE-2026-84504
EUVD
EUVD-2026-70984

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fastify fastify to 5.12.2 (exc)
fastify fastify From 5.12.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Fastify versions before 5.12.2. When an async JSON Schema validator resolves a request body, Fastify incorrectly treats the resolved object as a {value, error} wrapper. If the request body contains a 'value' property at the root, Fastify replaces the entire request body with this value before processing. This allows an attacker to manipulate the request data, bypassing schema validation and potentially triggering unauthorized operations or disclosing data.

Detection Guidance

To detect this vulnerability, check the version of Fastify in use. Run commands like 'npm list fastify' or 'yarn list fastify' in your project directory. If the version is below 5.12.2, the system is vulnerable. Additionally, review application routes using $async request schemas for potential exposure.

Impact Analysis

An authenticated low-privilege attacker could exploit this to replace the validated request body with arbitrary data. This could lead to unauthorized state changes, such as modifying data or triggering actions the application did not authorize. Sensitive operations relying on validated input may be compromised, resulting in data disclosure or integrity breaches.

Compliance Impact

This vulnerability could lead to unauthorized data disclosure or modification, violating GDPR's data integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using vulnerable Fastify versions may face compliance violations if exploited, potentially resulting in legal or regulatory penalties.

Mitigation Strategies

Immediately upgrade Fastify to version 5.12.2 or later. If upgrading is not possible, avoid using $async request schemas in routes. Move security-sensitive checks to hooks like onRequest or preHandler to prevent unauthorized state changes or data disclosure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart