{"schema":"threatline.record/2","record":{"id":"CVE-2026-84469","aliases":["GHSA-hwr6-493r-vm6h"],"summary":"fastify vulnerable to request validation bypass via skipped boolean false schemas","details":"### Impact\n\nFastify decided whether to validate a request part by checking its schema for JavaScript truthiness. JSON Schema Draft 7 defines the boolean `false` as a valid schema that rejects every instance, but because `false` is falsy, a route that set `body`, `querystring`, `params`, or `headers` to `false` had that part left uncompiled: no validator was attached and the request reached the handler. An application that used `false` as a deny-all schema to make a route unreachable was therefore fully bypassed, and an unauthenticated remote client could reach the handler with any input. The same applied to the documented `query` alias for `querystring`. This is a complete bypass rather than a weak-schema issue, since `false` is the strongest JSON Schema assertion and must always fail.\n\n### Patches\n\nRequest-part schemas are now selected by an explicit presence check rather than truthiness, so a boolean `false` (or `true`) schema is compiled and enforced, including through the `query` alias. Patched in fastify `5.12.2`. The fix is also included in the `6.0.0` release.\n\n### Workarounds\n\nIf upgrading is not immediately possible, express a deny-all request schema with an always-failing object schema instead of the boolean `false` (for example `{ \"not\": {} }`), or reject the request in an `onRequest` hook.","categories":["Frameworks"],"product":"fastify","vendor":"fastify","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-hwr6-493r-vm6h","source_modified_at":"2026-09-30T23:44:59Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fastify"},"range":"< 5.12.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84469","source_modified_at":"2026-09-04T19:34:13.735Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"fastify","vendor":"fastify","versions":[{"lessThan":"5.12.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.12.2","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-hwr6-493r-vm6h","source_modified_at":"2026-10-01T00:00:04.687101683Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"fastify","ecosystem":"npm","purl":"pkg:npm/fastify"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.12.2"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-hwr6-493r-vm6h","source_modified_at":"2026-09-30T23:44:59Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fastify"},"version":"5.12.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84469","source_modified_at":"2026-09-04T19:34:13.735Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fastify","ecosystem":null},"version":"5.12.2","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-hwr6-493r-vm6h","source_modified_at":"2026-10-01T00:00:04.687101683Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"fastify","ecosystem":"npm","purl":"pkg:npm/fastify"},"version":"5.12.2"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00492,"percentile":0.4139,"score_date":"2026-10-23"},"published_at":"2026-09-04T09:59:36.406Z","modified_at":"2026-10-01T00:00:04.687101683Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-hwr6-493r-vm6h","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T23:44:59Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-84469","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-04T19:34:13.735Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-hwr6-493r-vm6h","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-01T00:00:04.687101683Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84469","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84469","source":"GitHub Advisory Database"},{"url":"https://github.com/fastify/fastify/commit/7de6e81697778f9f41bd327a3b1c5c9a0d9637b4","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.2","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-hwr6-493r-vm6h","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-04T19:34:03.487072Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T00:00:04.687101683Z","content_hash":"7b5faf0355fcfbd9895b1c682a40dc9dcd5121906598e8345f07a37944c388ec"}}