CVE-2026-84504 · GHSA-667r-xxjv-c9mm

fastify vulnerable to request body replacement via an async validation result collision

Risk score: 61/100
CVSS: 8.1 v3.1
Exploit chance (30 days): 0.4%
Published: 30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Fastify runs a route's validator and, for a result shaped like { value, error }, unwraps it: an error becomes a validation failure and value replaces the request part. This convention is intended for synchronous custom compilers (for example Joi). A JSON Schema $async validator, however, resolves with the validated da…
Affected: fastify (npm) < 5.12.2
Fix: Upgrade fastify to 5.12.2 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

fastify: Amber, patch this week. Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler(). When the request method has no route in the main router, a malformed request target reaches Fastif…

The flaws

CVE-2026-84504: Fastify vulnerable to request body replacement via an async validation result collision (CVSS 8.1 · EPSS 0%)
CVE-2026-76169: Fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers (CVSS 7.5 · EPSS 1%)
CVE-2026-84428: Fastify vulnerable to header validation bypass via incomplete schema case normalization (CVSS 7.5 · EPSS 1%)
CVE-2026-84469: Fastify vulnerable to request validation bypass via skipped boolean false schemas (CVSS 7.5 · EPSS 0%)

The fix

Fix: Upgrade fastify to 5.12.2 or later.

Who is exposed: fastify (npm) >= 4.0.0, < 5.12.2

Where it stands

No known exploitation

Connects to

Same weakness: Authentication bypass (CWE-288). 33 other warnings in 30 days

Why it is Amber

CVSS 8.1 high
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
fastify	npm	< 5.12.2	5.12.2

References

Original description

### Impact Fastify runs a route's validator and, for a result shaped like `{ value, error }`, unwraps it: an `error` becomes a validation failure and `value` replaces the request part. This convention is intended for synchronous custom compilers (for example Joi). A JSON Schema `$async` validator, however, resolves with the validated data itself, so Fastify applied the same unwrapping to it. If a request part validated by an `$async` schema contains a `value` property, Fastify replaced the whole request part with that nested value before the handler ran, so a `value` or `error` property in the payload was attacker-controlled. An application that dispatches operations from the validated request body could then act on data that never satisfied the route schema, leading to unauthorized state changes or disclosure. Reaching the vulnerable path requires the route to use an `$async` request schema. ### Patches Fastify no longer treats an asynchronous validation result as a `{ value, error }` wrapper: an async validator's resolved value is used only to determine pass or fail, and it can no longer replace the request part or inject an error. The synchronous custom-compiler contract is unchanged. Patched in fastify `5.12.2` and `6.0.0`. ### Workarounds If upgrading is not immediately possible, avoid `$async` request schemas, or perform the security-sensitive check in an `onRequest` or `preHandler` hook rather than relying on the schema-validated request part. Custom async validator compilers should signal failure by throwing (rejecting) rather than returning an `{ error }` object.

Last activity 30 Sep 2026. Patch Forecast updates every hour.