Executive brief
Fastify is a web application framework used to build REST APIs and web services. A flaw in versions before 5.12.2 allows an authenticated attacker to inject a "value" property in the request body, which Fastify then uses to replace the entire validated request before passing it to the application handler. This can lead to unauthorized operations being performed and sensitive data being disclosed, as the application may execute actions on data that never passed schema validation.
Technical details
The vulnerability exists in Fastify's handling of asynchronous JSON Schema validators. Fastify applies the { value, error } unwrapping protocol—designed for synchronous custom validator compilers like Joi—to asynchronous Ajv validators. When a route schema uses $async validation, if the validated request body contains a "value" property at the root level, Fastify treats this as the validation result wrapper and replaces the entire request part with that nested value before the handler executes. An authenticated low-privilege attacker can craft a request with a "value" property containing arbitrary nested data to bypass schema validation. The attack requires the route to use an $async request schema. The fix, available in Fastify 5.12.2 and 6.0.0, no longer treats async validator results as { value, error } wrappers; async validators' resolved values are used only to determine pass/fail and cannot replace the request or inject errors.
Affected products
- Fastify fastify before 5.12.2
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Patched in fastify 5.12.2 and 6.0.0