{"id":"CVE-2026-84469","aliases":["CLSA-2026-1790854816","CLSA-2026-1790857029","CLSA-2026-1791629281","CLSA-2026-1791667225","CLSA-2026-1791806519","CLSA-2026-1791806950","CLSA-2026-1791839080","CLSA-2026-1794060794","EUVD-2026-70989","GHSA-hwr6-493r-vm6h"],"status":"published","title":"fastify vulnerable to request validation bypass via skipped boolean false schemas","description":"fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00492,"percentile":0.42614,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-09-04T09:59:36Z","modified":"2026-11-07T19:00:36Z","fixes":[{"ecosystem":"npm","package":"fastify","fixed_in":["5.12.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fastify","fixed_in":["4.29.1-tuxcare.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.1-tuxcare.0"},{"fixed":"5.12.1-tuxcare.1"}]}],"versions":["5.12.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.0-tuxcare.0"},{"fixed":"5.12.0-tuxcare.2"}]}],"versions":["5.12.0","5.12.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.29.5-tuxcare.0"},{"fixed":"3.29.5-tuxcare.7"}]}],"versions":["3.29.5","3.29.5-tuxcare.1","3.29.5-tuxcare.2","3.29.5-tuxcare.3","3.29.5-tuxcare.4","3.29.5-tuxcare.5","3.29.5-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.29.1-tuxcare.0"},{"fixed":"4.29.1-tuxcare.6"}]}],"versions":["4.29.1","4.29.1-tuxcare.1","4.29.1-tuxcare.2","4.29.1-tuxcare.3","4.29.1-tuxcare.4","4.29.1-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.4-tuxcare.0"},{"fixed":"5.7.4-tuxcare.5"}]}],"versions":["5.7.4","5.7.4-tuxcare.1","5.7.4-tuxcare.2","5.7.4-tuxcare.3","5.7.4-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-tuxcare.0"},{"fixed":"5.2.1-tuxcare.5"}]}],"versions":["5.2.1","5.2.1-tuxcare.1","5.2.1-tuxcare.2","5.2.1-tuxcare.3","5.2.1-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.3-tuxcare.0"},{"fixed":"5.11.3-tuxcare.6"}]}],"versions":["5.11.3","5.11.3-tuxcare.1","5.11.3-tuxcare.2","5.11.3-tuxcare.3","5.11.3-tuxcare.4","5.11.3-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.1-tuxcare.0"},{"fixed":"4.28.1-tuxcare.1"}]}],"versions":["4.28.1"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"fastify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.12.2"}]}]}],"products":[{"vendor":"@clerk","product":"fastify"},{"vendor":"fastify","product":"fastify"}],"references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h","tags":["Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84469","tags":["advisory"]},{"url":"https://github.com/fastify/fastify/commit/7de6e81697778f9f41bd327a3b1c5c9a0d9637b4","tags":["web"]},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hwr6-493r-vm6h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84469.json","tags":["advisory"]},{"url":"https://github.com/fastify/fastify","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-84469","title":"fastify vulnerable to request validation bypass via skipped boolean false schemas","description":"fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T09:59:36.406Z","modified":"2026-09-04T19:34:13.735Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-70989","description":"fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T09:59:36Z","modified":"2026-09-04T19:34:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:11.238356Z"}],"ghsa":[{"id":"GHSA-hwr6-493r-vm6h","title":"fastify vulnerable to request validation bypass via skipped boolean false schemas","description":"### Impact\n\nFastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean `false` as a valid schema that rejects every instance, but because `false` is falsy, a route that set `body`, `querystring`, `params`, or `headers` to `false` had that part left uncompiled: no validator was attached and the request reached the handler. An application that used `false` as a deny-all schema to make a route unreachable was therefore fully bypassed, and an unauthenticated remote client could reach the handler with any input. The same applied to the documented `query` alias for `querystring`. This is a complete bypass rather than a weak-schema issue, since `false` is the strongest JSON Schema assertion and must always fail.\n\n### Patches\n\nRequest-part schemas are now selected by an explicit presence check rather than truthiness, so a boolean `false` (or `true`) schema is compiled and enforced, including through the `query` alias. Patched in fastify `5.12.2`. The fix is also included in the `6.0.0` release.\n\n### Workarounds\n\nIf upgrading is not immediately possible, express a deny-all request schema with an always-failing object schema instead of the boolean `false` (for example `{ \"not\": {} }`), or reject the request in an `onRequest` hook.","status":"published","published":"2026-09-30T23:44:58Z","modified":"2026-09-30T23:44:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-84469","description":"fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T10:17:13.677Z","modified":"2026-09-15T20:06:50.543Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:43.737972Z"}],"osv":[{"id":"CVE-2026-84469","title":"fastify vulnerable to request validation bypass via skipped boolean false schemas","description":"fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T09:59:36.406Z","modified":"2026-10-28T02:30:38.493741834Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"GHSA-hwr6-493r-vm6h","title":"fastify vulnerable to request validation bypass via skipped boolean false schemas","description":"### Impact\n\nFastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean `false` as a valid schema that rejects every instance, but because `false` is falsy, a route that set `body`, `querystring`, `params`, or `headers` to `false` had that part left uncompiled: no validator was attached and the request reached the handler. An application that used `false` as a deny-all schema to make a route unreachable was therefore fully bypassed, and an unauthenticated remote client could reach the handler with any input. The same applied to the documented `query` alias for `querystring`. This is a complete bypass rather than a weak-schema issue, since `false` is the strongest JSON Schema assertion and must always fail.\n\n### Patches\n\nRequest-part schemas are now selected by an explicit presence check rather than truthiness, so a boolean `false` (or `true`) schema is compiled and enforced, including through the `query` alias. Patched in fastify `5.12.2`. The fix is also included in the `6.0.0` release.\n\n### Workarounds\n\nIf upgrading is not immediately possible, express a deny-all request schema with an always-failing object schema instead of the boolean `false` (for example `{ \"not\": {} }`), or reject the request in an `onRequest` hook.","status":"published","published":"2026-09-30T23:44:58Z","modified":"2026-10-01T00:00:04.687101683Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"CLSA-2026-1790854816","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.1-tuxcare.1.","status":"published","published":"2026-10-01T11:40:16Z","modified":"2026-10-15T09:47:59.984131956Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790857029","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.0-tuxcare.2.","status":"published","published":"2026-10-01T12:17:09Z","modified":"2026-10-15T09:47:59.910201248Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791629281","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 3.29.5-tuxcare.7.","status":"published","published":"2026-10-10T10:48:01Z","modified":"2026-10-15T09:47:59.791422398Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791667225","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 4.29.1-tuxcare.6.","status":"published","published":"2026-10-10T21:20:25Z","modified":"2026-10-15T09:47:39.874594658Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806519","title":"TuxCare security update for fastify (3 CVEs)","description":"TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.7.4-tuxcare.5.","status":"published","published":"2026-10-12T12:01:59Z","modified":"2026-10-15T09:47:40.246927962Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806950","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.2.1-tuxcare.5.","status":"published","published":"2026-10-12T12:09:10Z","modified":"2026-10-15T09:47:40.357309285Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791839080","title":"TuxCare security update for fastify (3 CVEs)","description":"TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.11.3-tuxcare.6.","status":"published","published":"2026-10-12T21:04:40Z","modified":"2026-10-15T09:45:52.229940845Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1794060794","title":"TuxCare security update for fastify (6 CVEs)","description":"TuxCare rebuilt fastify to address 6 CVEs. Fixed in 4.28.1-tuxcare.1.","status":"published","published":"2026-11-07T15:13:14Z","modified":"2026-11-07T19:00:36.656813145Z","updated_at":"2026-11-07T19:21:34.633914Z"}]}}