CVE-2026-84469: Fastify Authentication Bypass Vulnerability

CVE-2026-84469 Overview

CVE-2026-84469 is an input validation flaw ([CWE-20]) in the Fastify Node.js web framework affecting versions before 5.12.2. Fastify determines whether to compile a request schema using JavaScript truthiness. This conflicts with JSON Schema Draft 7, which defines the boolean false as a valid schema that rejects every instance. When a developer assigns false to a route's body, querystring, params, or headers schema to deny all input, Fastify treats it as missing and compiles no validator. The route handler then runs on any request, producing a complete validation bypass reachable by unauthenticated remote clients.

Critical Impact
Unauthenticated remote attackers can reach handlers that were explicitly guarded by a deny-all schema, enabling unauthorized state changes or invocation of operations intended to be disabled.

Affected Products

Fastify versions prior to 5.12.2
Node.js applications using Fastify route schemas set to false
Downstream frameworks and services embedding vulnerable Fastify releases

Discovery Timeline

2026-09-04 - CVE-2026-84469 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84469

Vulnerability Analysis

Fastify uses request schemas to validate incoming HTTP payloads before invoking route handlers. The framework's compilation logic checks whether a schema value is truthy before generating a validator. Because the boolean false is falsy in JavaScript, Fastify skips compilation entirely when a developer sets a schema property to false.

JSON Schema Draft 7 treats false as a legitimate schema that rejects every instance. Developers relying on that semantic assign false to body, querystring, params, or headers to guarantee that no request passes validation. Under CVE-2026-84469, Fastify interprets this configuration as "no schema defined" and passes every request through to the handler.

The result is a divergence between developer intent and runtime behavior. Endpoints designed to be unreachable become fully reachable, and any downstream authorization or state-change logic executes on untrusted input.

Root Cause

The root cause is a type-coercion mismatch. Fastify's schema selection relies on JavaScript truthiness rather than an explicit check for undefined or null. This diverges from the JSON Schema specification, where the boolean literals true and false are valid schemas with defined semantics.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to a route whose body, querystring, params, or headers schema was set to false. Fastify skips validation and dispatches the request to the handler. Depending on the handler's logic, this can lead to unauthorized writes, invocation of disabled features, or exposure of privileged operations.

No exploitation code is required beyond a normal HTTP request. See the GitHub Fastify Security Advisory for the vendor's technical description.

Detection Methods for CVE-2026-84469

Indicators of Compromise

Successful HTTP responses from routes whose source code assigns false to body, querystring, params, or headers schemas.
Handler-side application logs showing execution for endpoints that were intended to reject all input.
Unexpected state changes triggered through routes documented as disabled or deny-all.

Detection Strategies

Perform static analysis of Fastify route definitions to locate any schema property assigned the literal false.
Compare installed fastify package versions against 5.12.2 using npm ls fastify or software composition analysis tooling.
Instrument routes with pre-handler hooks that log invocations and cross-reference with routes expected to be unreachable.

Monitoring Recommendations

Alert on HTTP 2xx responses from endpoints declared as deny-all in application configuration inventories.
Ingest application and reverse-proxy logs into a centralized analytics platform to surface anomalous request patterns to sensitive routes.
Track dependency drift for Fastify across build pipelines and production runtimes to catch regressions after remediation.

How to Mitigate CVE-2026-84469

Immediate Actions Required

Upgrade Fastify to version 5.12.2 or later in all production, staging, and build environments.
Audit route definitions for any schema property set to the boolean false and confirm the intended behavior after upgrade.
Add server-side authorization checks to handlers that were previously relying solely on a deny-all schema.

Patch Information

Fastify 5.12.2 corrects the schema selection logic so that the boolean false is recognized as a valid deny-all schema per JSON Schema Draft 7. Refer to the OpenJS Foundation Security Advisories and the GitHub Fastify Security Advisory for the official patch details.

Workarounds

Replace false schemas with an explicit rejecting schema such as { not: {} } that Fastify's truthiness check treats as present.
Register a preValidation or preHandler hook that unconditionally returns an error response for routes intended to be unreachable.
Remove or disable the affected routes at the application router or reverse-proxy layer until the upgrade is deployed.

bash

# Upgrade Fastify to the patched release
npm install fastify@^5.12.2
npm ls fastify