CVE-2026-84504: Fastify request body replacement via async validation result collision

CVE-2026-84504 · Severity: high · CVSS 8.1 · Published 2026-09-04

Fastify is a web application framework used to build REST APIs and web services. A flaw in versions before 5.12.2 allows an authenticated attacker to inject a "value" property in the request body, which Fastify then uses to replace the entire validated request before passing it to the application handler. This can lead to unauthorized operations being performed and sensitive data being disclosed, as the application may execute actions on data that never passed schema validation.

Technologies: fastify (npm). Vendors: npm.

Quick answers

Is CVE-2026-84504 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84504 being exploited in the wild.
How severe is CVE-2026-84504?
High severity, with a CVSS score of 8.1, published 4 September 2026.
Which products and versions are affected?
fastify (npm) < 5.12.2, SEMVER:introduced=0,fixed=5.12.2.
Is there a fix for CVE-2026-84504?
Yes. fastify (npm): upgrade to 5.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84504 attacked?
It is attacked over the network.
Am I affected by CVE-2026-84504?
Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fastify (npm): upgrade to 5.12.2 or later
    npm install fastify@5.12.2

Technical details

The vulnerability exists in Fastify's handling of asynchronous JSON Schema validators. Fastify applies the { value, error } unwrapping protocol—designed for synchronous custom validator compilers like Joi—to asynchronous Ajv validators. When a route schema uses $async validation, if the validated request body contains a "value" property at the root level, Fastify treats this as the validation result wrapper and replaces the entire request part with that nested value before the handler executes. An authenticated low-privilege attacker can craft a request with a "value" property containing arbitrary nested data to bypass schema validation. The attack requires the route to use an $async request schema. The fix, available in Fastify 5.12.2 and 6.0.0, no longer treats async validator results as { value, error } wrappers; async validators' resolved values are used only to determine pass/fail and cannot replace the request or inject errors.

Affected products

  • Fastify fastify before 5.12.2

Identifiers

  • CVE-2026-84504
  • GHSA-667r-xxjv-c9mm

Timeline

  • 2026-09-04: disclosed
  • 2026-09-04: patched: Patched in fastify 5.12.2 and 6.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.