fastify CVE-2026-84469

Exploitation requires that the target fastify application (version < 5.12.2) has at least one route where the schema configuration includes a boolean false value for body, querystring, params, or headers (e.g., { schema: { body: false } }). This pattern must have been chosen by the developer to enforce a deny-all restriction on that route. Applications using conventional JSON Schema objects or no schema at all are not affected. The attacker must be able to reach the affected HTTP endpoint over the network - no authentication is required (CVSS PR:N). Exploitation is limited to routes that explicitly use the false-schema pattern, which is semantically valid per JSON Schema Draft 7 but uncommon in most codebases; teams should audit route definitions before concluding they are unexposed.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 7.5) accurately reflects the network-reachability and no-authentication character of this flaw when a vulnerable route exists. However, the real-world attack surface is materially narrower than a raw 7.5 implies: exploitation requires that the target application deliberately uses false as a schema value on at least one route, which is a valid but uncommon pattern. Applications using conventional object schemas or omitting schemas entirely are not affected by this bypass. No EPSS data was provided; KEV status is not listed, meaning no confirmed active exploitation exists. No public PoC is identified at time of analysis. SSVC assessment: exploitation is not yet demonstrated; the flaw is automatable once a vulnerable route is identified; technical impact is partial (integrity only, no confidentiality or availability). Net priority: medium for most deployments, elevated for applications that intentionally use false schemas as an access boundary (e.g., to gate disabled features or privileged API surfaces behind a permanent reject).

An attacker audits a fastify-based API for routes where no validation errors are returned despite sending malformed or empty payloads that the application's documentation suggests should be rejected. Upon discovering that a route intended to be permanently disabled - protected by schema: { body: false } - accepts arbitrary POST bodies and executes its handler, the attacker submits crafted payloads to trigger unauthorized state changes such as account modifications, feature toggles, or administrative operations. No exploit code is required; a standard HTTP client suffices.