Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-84504— fastify vulnerable to request body replacement via an async validation result collision

Quick assessment

Affected
fastify fastify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fastify 5.12.2 之前的版本中，当 Ajv 异步校验器成功解析出的对象，会被当作自定义校验器编译器所采用的“值结果协议”中的结果值。如果某个通过路由 schema 校验的请求在根节点包含一个名为 的属性，fastify 会在处理器执行前，用该属性的值替换掉整个请求体，导致处理器接收到的对象与通过 schema 校验时的对象不一致。经过认证的、权限较低的用户可以利用这一行为，让嵌套数据替换掉已校验的请求体，从而触发路由 schema 未授权的操作，导致未授权的状态变更和数据泄露。建议用户升级到 fasti

CVSS 8.1 · High EPSS 0.39% · P32

Affected Version Matrix 2

VendorProduct Version RangeStatus
fastify fastify < 5.12.2 affected
5.12.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84504

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fastify vulnerable to request body replacement via an async validation result collision
Source: CVE Program / CVE List V5
Vulnerability Description
fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fastify fastify 0 ~ 5.12.2 -

II. Public POCs for CVE-2026-84504

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84504

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-84504 (1)

Same Patch Batch · fastify · 2026-09-04 · 4 CVEs total

CVE-2026-76169 7.5 HIGH fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-f
CVE-2026-84428 7.5 HIGH fastify vulnerable to header validation bypass via incomplete schema case normalization
CVE-2026-84469 7.5 HIGH fastify vulnerable to request validation bypass via skipped boolean false schemas

IV. Related Vulnerabilities

Same product: fastify
Same vendor: fastify
Same weakness: CWE-20

V. Comments for CVE-2026-84504

No comments yet

Leave a comment