CVE-2026-84469: Fastify request validation bypass via skipped boolean false schemas

CVE-2026-84469 · Severity: high · CVSS 7.5 · Published 2026-09-04

Fastify is a popular web framework for Node.js used to build APIs and web services. A flaw in its request validation logic allowed attackers to reach handlers that were supposed to be completely blocked by deny-all schemas, enabling unauthorized operations or data modification. The vulnerability affects routes where developers explicitly set validation to false to prevent all requests—instead, those requests were processed normally, fully bypassing the intended access control.

Technologies: fastify (npm). Vendors: npm.

Quick answers

Is CVE-2026-84469 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84469 being exploited in the wild.
How severe is CVE-2026-84469?
High severity, with a CVSS score of 7.5, published 4 September 2026.
Which products and versions are affected?
fastify (npm) < 5.12.2, SEMVER:introduced=0,fixed=5.12.2.
Is there a fix for CVE-2026-84469?
Yes. fastify (npm): upgrade to 5.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84469 attacked?
It is attacked over the network.
Am I affected by CVE-2026-84469?
Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fastify (npm): upgrade to 5.12.2 or later
    npm install fastify@5.12.2

Technical details

The vulnerability is an improper input validation flaw (CWE-20) in Fastify's schema compilation logic. Fastify checked whether to compile request validation schemas using JavaScript truthiness; however, JSON Schema Draft 7 defines the boolean false as a valid schema that rejects all instances. When a route schema for body, querystring, params, or headers was set to false (the strongest JSON Schema assertion), Fastify treated it as falsy and skipped validator compilation entirely. An unauthenticated remote attacker on the network could send any request to such a route and reach the handler without validation, completely bypassing the deny-all schema. The fix, available in Fastify 5.12.2 and 6.0.0, uses explicit presence checks instead of truthiness evaluation for schema compilation.

Affected products

  • Fastify fastify before 5.12.2

Identifiers

  • CVE-2026-84469
  • GHSA-hwr6-493r-vm6h

Timeline

  • 2026-09-04: disclosed: CVE-2026-84469 published; advisory GHSA-hwr6-493r-vm6h released
  • 2026-09-04: patched: Patched in fastify 5.12.2 and 6.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.