CVE-2026-84504 fastify CVE debrief

Who should care

Defenders of systems using Fastify versions before 5.12.2 should assess exposure and prioritize upgrading to Fastify 5.12.2 or later to prevent unauthorized state changes and data disclosure.

Why it matters

CVE-2026-84504 is a vulnerability in Fastify versions before 5.12.2 that allows an authenticated low-privilege caller to make unauthorized state changes and data disclosure by replacing the validated request body with a property named 'value' at the root of the request. Defenders of systems using Fastify should assess exposure and prioritize upgrading to Fastify 5.12.2 or later.

• Potential unauthorized state changes
• Potential data disclosure due to request body replacement
• Need to verify and update route schemas to prevent exploitation
• Priority on upgrading to Fastify 5.12.2 or later

Technical summary

The vulnerability is caused by Fastify's treatment of the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named 'value' at the root, Fastify replaces the entire request body with that property's value before the handler runs, allowing an authenticated low-privilege caller to make unauthorized state changes and data disclosure.

Defensive priority

Upgrade to Fastify 5.12.2 or later to prevent unauthorized state changes and data disclosure.

Recommended defensive actions

• Upgrade to Fastify 5.12.2 or later
• Review and update route schemas to prevent unauthorized state changes
• Monitor for suspicious requests with a 'value' property at the root
• Verify and update route schemas to prevent exploitation
• Prioritize upgrading to Fastify 5.12.2 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is caused by Fastify's treatment of the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named 'value' at the root, Fastify replaces the entire request body with that property's value before the handler runs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.