{"vulnerability": "CVE-2026-8446", "sightings": [{"uuid": "c23864f5-ef86-4bb8-b987-1377edf4eb7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8446", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mse4aow6hz2l", "content": "\ud83d\udfe0 CVE-2026-8446 - High (7.5)\n\nIBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-8446/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-05T18:00:52.741084Z"}, {"uuid": "dc2a017e-24c4-41be-976d-1ab479ef73c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84469", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3muopjry6ps25", "content": "\ud83d\udea8 High-severity security fix in fastify@5.12.2 just released!\n\nPatches CVE-2026-84469: request validation bypass via skipped boolean false schemas.\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-09-04T10:03:01.447566Z"}, {"uuid": "b9758739-f2df-455b-8c6e-fe5e0474cc16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84462", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgkfdtafl25", "content": "CVE-2026-84462 - zammad\nThe Zammad help\u2011desk system before version 7.1.2 lets a user with admin rights edit an AI Agent and insert specially crafted text that bypasses a safety filter. When the AI Agent processes a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#zammad #CVE #infosec", "creation_timestamp": "2026-09-26T15:00:06.981044Z"}, {"uuid": "4de7a45b-fbd7-41ac-8ba2-6f1c65b637a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84469", "type": "seen", "source": "https://gist.github.com/alon710/8fe839e7f5a3ba983a1c7d00f7bd0198", "content": "# CVE-2026-84469: CVE-2026-84469: Request Validation Bypass in Fastify via Loose Boolean Schema Evaluation\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84469\n\n## Summary\nCVE-2026-84469 is a high-severity request validation bypass vulnerability in the Fastify Node.js web framework. In versions prior to 5.12.2, Fastify uses loose truthiness checks to decide whether to compile request schemas. When a component (such as the body) is explicitly configured with a boolean 'false' schema\u2014which under JSON Schema Draft 7 acts as a 'deny-all' constraint\u2014Fastify's internal logic evaluates this as a falsy value and skips compilation entirely. This allows unauthenticated remote attackers to send arbitrary payloads to these endpoints, bypassing validation checks and directly executing backend route handlers.\n\n## TL;DR\nFastify fails to compile validation schemas configured as boolean 'false', causing 'deny-all' schemas to be completely ignored. Unauthenticated remote attackers can bypass payload validation and execute backend route handlers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20: Improper Input Validation\n- **Attack Vector**: Network (Remote)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00492 (Percentile: 39.86%)\n- **Impact**: Validation Bypass / Integrity Compromise\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Fastify Web Framework\n- **Fastify**: >= 0.1.0, < 5.12.2 (Fixed in: `5.12.2`)\n\n## Mitigation\n\n- Upgrade to Fastify version 5.12.2 or later.\n- Rewrite boolean false schemas to equivalent explicit JSON objects that reject all input.\n- Implement preValidation or preHandler hooks to manually drop requests on affected endpoints.\n\n**Remediation Steps:**\n1. Analyze the codebase to locate routes where body: false, querystring: false, params: false, or headers: false are declared.\n2. Apply the patch by updating the Fastify package dependency using 'npm install fastify@5.12.2' or 'yarn upgrade fastify@5.12.2'.\n3. Verify that endpoints configured with boolean false schemas properly return HTTP 400 Bad Request responses when subjected to random testing payloads.\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-84469)\n- [NVD Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-84469)\n- [GitHub Security Advisory](https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84469) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T11:30:30.000000Z"}]}