CVE-2026-84504 fastify CVE debrief

Who should care

Defenders and developers using fastify versions before 5.12.2 should assess exposure and prioritize upgrading to fastify 5.12.2 or later to prevent unauthorized state changes and data disclosure.

Why it matters

CVE-2026-84504 is a high-severity vulnerability in fastify that allows an authenticated low-privilege caller to make unauthorized state changes and disclose data. Defenders and developers using fastify versions before 5.12.2 should assess exposure and prioritize upgrading to fastify 5.12.2 or later.

• Unauthorized state changes due to manipulation of request body
• Data disclosure due to unauthorized access
• Potential for lateral movement and further exploitation
• Need for verification of affected systems and upgrade to fixed version

Technical summary

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema.

Defensive priority

Upgrade to fastify 5.12.2 or later to prevent unauthorized state changes and data disclosure.

Recommended defensive actions

• Upgrade to fastify 5.12.2 or later
• Review and update affected systems
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by fastify's treatment of the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.