CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas
Attackers can bypass request validation in Fastify by exploiting a truthiness bug, allowing unauthorized access to handlers intended to be disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84469?
CVE-2026-84469 is a high-severity vulnerability in fastify, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.
Weakness: CWE-20
Which versions are affected by CVE-2026-84469?
2 open source packages ship an affected version, including fastify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fastify npm | All versions | 5.12.2 |
fastify npm | All versions | 5.12.2 |
Products include Fastify Fastify.
How do I fix CVE-2026-84469?
Upgrade fastify to 5.12.2 or later.
Is CVE-2026-84469 being exploited?
There is no known exploitation of CVE-2026-84469 in the wild and no public exploit code.
Other vulnerabilities in fastify
- CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision
- CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
- CVE-2026-25223 Fastify's Content-Type header tab character allows body validation bypass
Sources
Also known as CLSA-2026-1791667225, GHSA-hwr6-493r-vm6h, MINI-82m3-26hw-q684.