CVE-2026-84504

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.2

Description An issue exists where the object resolved by a successful Ajv async validator is treated as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, the software replaces the entire request body with the value of that property before the handler executes. This results in the handler receiving an object different from the one that satisfied the schema. An authenticated low-privilege caller can exploit this to replace the validated body with nested data, potentially triggering unauthorized operations, leading to unauthorized state changes and data disclosure.

Recommendations Upgrade to fastify version 5.12.2 or later.