{"uuid": "4de7a45b-fbd7-41ac-8ba2-6f1c65b637a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84469", "type": "seen", "source": "https://gist.github.com/alon710/8fe839e7f5a3ba983a1c7d00f7bd0198", "content": "# CVE-2026-84469: CVE-2026-84469: Request Validation Bypass in Fastify via Loose Boolean Schema Evaluation\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84469\n\n## Summary\nCVE-2026-84469 is a high-severity request validation bypass vulnerability in the Fastify Node.js web framework. In versions prior to 5.12.2, Fastify uses loose truthiness checks to decide whether to compile request schemas. When a component (such as the body) is explicitly configured with a boolean 'false' schema\u2014which under JSON Schema Draft 7 acts as a 'deny-all' constraint\u2014Fastify's internal logic evaluates this as a falsy value and skips compilation entirely. This allows unauthenticated remote attackers to send arbitrary payloads to these endpoints, bypassing validation checks and directly executing backend route handlers.\n\n## TL;DR\nFastify fails to compile validation schemas configured as boolean 'false', causing 'deny-all' schemas to be completely ignored. Unauthenticated remote attackers can bypass payload validation and execute backend route handlers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20: Improper Input Validation\n- **Attack Vector**: Network (Remote)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00492 (Percentile: 39.86%)\n- **Impact**: Validation Bypass / Integrity Compromise\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Fastify Web Framework\n- **Fastify**: >= 0.1.0, < 5.12.2 (Fixed in: `5.12.2`)\n\n## Mitigation\n\n- Upgrade to Fastify version 5.12.2 or later.\n- Rewrite boolean false schemas to equivalent explicit JSON objects that reject all input.\n- Implement preValidation or preHandler hooks to manually drop requests on affected endpoints.\n\n**Remediation Steps:**\n1. Analyze the codebase to locate routes where body: false, querystring: false, params: false, or headers: false are declared.\n2. Apply the patch by updating the Fastify package dependency using 'npm install fastify@5.12.2' or 'yarn upgrade fastify@5.12.2'.\n3. Verify that endpoints configured with boolean false schemas properly return HTTP 400 Bad Request responses when subjected to random testing payloads.\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-84469)\n- [NVD Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-84469)\n- [GitHub Security Advisory](https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84469) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T11:30:30.000000Z"}