CVE-2026-84469: Fastify Request Validation Bypass via Skipped Boolean False Schemas
Summary
CVE-2026-84469: fastify vulnerable to request validation bypass via skipped boolean false schemas. Affects fastify versions < 5.12.2. Fixed in 5.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework designed for building efficient and scalable server-side applications in Node.js. It is known for its high performance and low overhead, making it a popular choice for developers. However, it has a vulnerability that allows for request validation bypass, which can lead to unauthorized access to application handlers.
Vulnerability Detail
The vulnerability arises from Fastify's method of determining whether to validate a request part based on JavaScript truthiness. In JSON Schema Draft 7, a boolean 'false' is a valid schema that should reject all instances. However, since 'false' is considered falsy in JavaScript, routes that set 'body', 'querystring', 'params', or 'headers' to 'false' do not compile a validator, allowing unauthenticated remote clients to bypass validation and reach the handler with any input. This is a complete bypass of security measures, as 'false' is intended to deny all requests.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.12.2
This is the first release that contains the fix.
npm install fastify@5.12.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can implement a workaround by using an always-failing object schema instead of the boolean 'false'. For example, you can define your request schema as follows: { "not": {} }. This will effectively deny all requests until you can upgrade.
Conclusion
The CVE-2026-84469 vulnerability in Fastify poses a significant risk by allowing request validation bypass through the use of boolean false schemas. It is crucial to update to the patched version or implement the recommended workarounds to secure your application.
See every vulnerability recorded for fastify →
FAQ
CVE-2026-84469 is a vulnerability in Fastify that allows for request validation bypass due to the improper handling of boolean false schemas.
This vulnerability can allow unauthorized users to access application handlers without proper validation, potentially leading to data exposure or manipulation.
Versions of Fastify prior to 5.12.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
