CVE-2026-84469
Last modified
CVE-2026-84469 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fastify | Fastify | < 5.12.2 |
References
- https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
- https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6hMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-84469?
How severe is CVE-2026-84469?
How do I fix CVE-2026-84469?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-84441A security vulnerability has been detected in Piwigo up to 1…7.3
- CVE-2026-84442A vulnerability was identified in MapQuest Get Directions Ap…4.4
- CVE-2026-84445gRPC-Go is the Go language implementation of gRPC. Prior to …8.7
- CVE-2026-8445justhtml versions <= 1.11.0 (fixed in 1.12.0) do not suffici…9.8
- CVE-2026-84452Windows ML CLI is a command line tool for building portable,…8.6
- CVE-2026-8446IBM Langflow OSS 1.0.0 through 1.10.3 contain an authenticat…7.5
- CVE-2026-8447IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored c…6.1
- CVE-2026-84470A flaw was found in Ansible Automation Platform's automation…6.4
- CVE-2026-84476WWBN AVideo fails to validate trusted proxies before accepti…7.5
- CVE-2026-84477AVideo Live_schedule::setTitle() and setDescription() store …5.4
- CVE-2026-84478WWBN AVideo contains a path traversal vulnerability in the A…7.3
- CVE-2026-84479WWBN AVideo (current e01e41ecc and earlier) makes three logi…9.1
Are you affected by CVE-2026-84469?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST