CVE-2026-84504: Fastify Authentication Bypass Vulnerability

CVE-2026-84504 Overview

CVE-2026-84504 affects Fastify versions before 5.12.2, a widely used Node.js web framework. The framework mishandles the object returned by successful Ajv async validators, treating it as the value result protocol used by custom validator compilers. When a request body passes schema validation and contains a root property named value, Fastify replaces the entire request body with that property's contents before invoking the route handler. The handler then receives an object different from the one validated against the route schema. This input validation flaw [CWE-20] enables authenticated low-privilege callers to bypass schema-based authorization checks.

Critical Impact
Authenticated attackers can smuggle unauthorized payloads past route schema validation, resulting in unauthorized state changes and disclosure of sensitive data.

Affected Products

Fastify versions prior to 5.12.2
Node.js applications using Fastify with Ajv async validators
Fastify routes relying on schema validation for authorization decisions

Discovery Timeline

2026-09-04 - CVE-2026-84504 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84504

Vulnerability Analysis

Fastify supports multiple validator compilers, including Ajv. Custom validator compilers may return an object of the form { value: <transformed> } to signal that the validated body should be replaced with a coerced or transformed value. Fastify does not distinguish between this internal result protocol and the object returned by a successful Ajv async validator. When Ajv async validation resolves to an object containing a root-level value property, Fastify treats that property as the replacement body.

The route handler subsequently operates on attacker-controlled nested data rather than the payload that satisfied the schema. Any authorization or business logic relying on schema-validated fields is bypassed, since those fields no longer exist on the object the handler processes.

Root Cause

The root cause is ambiguous handling of validator return values. Fastify assumes that any object with a value property returned from validation represents a transformation directive. This assumption is unsafe when Ajv async validators return the validated payload itself, because attackers control the payload's structure and can embed arbitrary nested data under the value key.

Attack Vector

An authenticated low-privilege caller crafts a JSON body that passes the route's schema and includes a top-level value property containing a nested object. The nested object holds fields or operations the caller is not authorized to submit. Fastify's post-validation body replacement swaps the outer object for the nested payload, and the handler processes the unauthorized data as if it had been validated.

Technical details are available in the GitHub Fastify Security Advisory GHSA-667r-xxjv-c9mm and the OpenJS Foundation Security Advisories.

Detection Methods for CVE-2026-84504

Indicators of Compromise

Request bodies containing a root-level value property submitted to routes backed by Ajv async validators
Unexpected state changes on routes where authorization depends on schema-declared fields
Handler logs showing processed payloads whose structure differs from the declared request schema

Detection Strategies

Inventory all Fastify routes that use async Ajv validators or custom validator compilers returning { value }
Audit application logs for requests where the pre-validation and post-validation body diverge
Add middleware to log or reject payloads that include a top-level value property when the route schema does not declare it

Monitoring Recommendations

Track outbound responses that expose fields the requesting role should not access
Alert on privileged operations executed by low-privilege authenticated identities
Monitor application dependency manifests for Fastify versions below 5.12.2

How to Mitigate CVE-2026-84504

Immediate Actions Required

Upgrade Fastify to version 5.12.2 or later across all services
Enumerate routes that combine Ajv async validation with authorization decisions based on validated fields
Enforce server-side authorization checks that do not rely solely on schema-validated request bodies

Patch Information

The maintainers released Fastify 5.12.2 to correct the interpretation of Ajv async validator return values. After upgrading, Fastify no longer treats a successful async validation result as a body-replacement directive. Refer to the GitHub Fastify Security Advisory GHSA-667r-xxjv-c9mm for release notes and remediation guidance.

Workarounds

Replace async Ajv validators with synchronous equivalents until the upgrade is deployed
Reject requests whose bodies contain a root value property unless the route schema explicitly permits it
Re-validate the request body inside the handler against the expected schema before performing privileged operations

bash

# Upgrade Fastify to the patched release
npm install fastify@^5.12.2

# Verify the installed version
npm ls fastify