Executive brief
Fastify is a popular web framework for Node.js used to build APIs and web services. A flaw in its request validation logic allowed attackers to reach handlers that were supposed to be completely blocked by deny-all schemas, enabling unauthorized operations or data modification. The vulnerability affects routes where developers explicitly set validation to false to prevent all requests—instead, those requests were processed normally, fully bypassing the intended access control.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in Fastify's schema compilation logic. Fastify checked whether to compile request validation schemas using JavaScript truthiness; however, JSON Schema Draft 7 defines the boolean false as a valid schema that rejects all instances. When a route schema for body, querystring, params, or headers was set to false (the strongest JSON Schema assertion), Fastify treated it as falsy and skipped validator compilation entirely. An unauthenticated remote attacker on the network could send any request to such a route and reach the handler without validation, completely bypassing the deny-all schema. The fix, available in Fastify 5.12.2 and 6.0.0, uses explicit presence checks instead of truthiness evaluation for schema compilation.
Affected products
- Fastify fastify before 5.12.2
Timeline
- 2026-09-04: disclosed: CVE-2026-84469 published; advisory GHSA-hwr6-493r-vm6h released
- 2026-09-04: patched: Patched in fastify 5.12.2 and 6.0.0