CVE-2026-84504
CVE-2026-84504 is a high-severity vulnerability in Fastify with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.
Key facts
- Severity: High (CVSS 3.x base score 8.1)
- EPSS exploit prediction: 0% (34th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-20
- Affected product: Fastify
- Published:
- Last modified:
Description
fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.
Frequently asked questions
- What is CVE-2026-84504?
- fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.
- How severe is CVE-2026-84504?
- CVE-2026-84504 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
- Is CVE-2026-84504 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-84504?
- CVE-2026-84504 affects Fastify. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-84504?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-84504 published?
- CVE-2026-84504 was published on 2026-09-04 and last updated on 2026-09-15.
References
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
Affected products (1)
- cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*
More vulnerabilities in Fastify
- CVE-2026-84428 — High (CVSS 7.5): fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a…
- CVE-2026-84469 — High (CVSS 7.5): fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON…
- CVE-2026-76169 — High (CVSS 7.5): fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom…
- CVE-2026-33806 — High (CVSS 7.5): Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation…
- CVE-2026-25223 — High (CVSS 7.5): Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass…
- CVE-2025-32442 — High (CVSS 7.5): Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0,…
Other CWE-20 (Improper Input Validation) vulnerabilities
- CVE-2026-77554 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi…
- CVE-2026-77537 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi…
- CVE-2026-48056 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0…
- CVE-2026-33267 — Critical (CVSS 10.0): Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0…
- CVE-2026-47668 — Critical (CVSS 10.0): DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST…
- CVE-2026-16117 — Critical (CVSS 10.0): Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix…
Browse all CWE-20 (Improper Input Validation) vulnerabilities →