CVE-2026-84504: Fastify Request Body Replacement Vulnerability
Summary
CVE-2026-84504: fastify vulnerable to request body replacement via an async validation result collision. Affects fastify versions < 5.12.2. Fixed in 5.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js that is designed to be highly performant and low overhead. It allows developers to build web applications and APIs with ease, supporting a wide range of plugins and features. However, Fastify has a vulnerability that arises when using asynchronous validation schemas, which can lead to unauthorized data manipulation and security breaches.
Vulnerability Detail
The vulnerability in Fastify occurs due to the way it handles validation results from asynchronous JSON Schema validators. When a request part is validated using an async schema that returns a 'value' property, Fastify incorrectly replaces the entire request part with this nested value. This can allow an attacker to control the request payload, leading to unauthorized state changes or data disclosure. The issue is particularly concerning when the application relies on the validated request body for critical operations, as it can bypass the intended validation checks.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.12.2
This is the first release that contains the fix.
npm install fastify@5.12.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider avoiding the use of asynchronous request schemas. Alternatively, implement security-sensitive checks in an 'onRequest' or 'preHandler' hook instead of relying solely on the schema-validated request part. Custom async validator compilers should signal failure by throwing an error rather than returning an error object.
Conclusion
The vulnerability CVE-2026-84504 in Fastify poses significant risks to applications that utilize asynchronous validation schemas. It is crucial to update to the patched version or implement workarounds to mitigate potential security threats. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for fastify →
FAQ
CVE-2026-84504 is a vulnerability in the Fastify web framework that allows for request body replacement through asynchronous validation result collisions.
This vulnerability can lead to unauthorized state changes or data disclosure if your application relies on the validated request body for critical operations.
All versions of Fastify prior to 5.12.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
