CVE-2026-84469

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.2

Description Fastify incorrectly determines whether to compile a request schema based on JavaScript truthiness. According to JSON Schema Draft 7, a boolean false is a valid schema that rejects all instances. However, when false is assigned to a route's body, querystring, params, or headers schema to deny all input, the software treats it as a missing schema and fails to compile a validator. This allows an unauthenticated remote client to bypass validation and reach handlers intended to be unreachable, potentially leading to unauthorized state changes or the execution of disabled operations.

Recommendations Upgrade to fastify version 5.12.2 or later.