Fastify CVE-2026-84504

Exploitation requires three concrete conditions to align simultaneously. First, the targeted Fastify route must be configured with a custom validator compiler that produces Ajv async validators (routes using synchronous validators are not affected). Second, the attacker must hold a valid low-privilege authenticated session - unauthenticated callers are excluded because PR:L is required per the CVSS vector. Third, the route must accept a JSON body and the attacker must be able to include a root-level value property in that body without the schema rejecting it outright (e.g., the schema uses additionalProperties: true or does not prohibit a value key). Routes whose schemas would fail validation on any body containing a root value key are less exposed in practice. Fastify versions 5.12.2 and later are not affected.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) yields a score of 8.1, which is broadly consistent with the described impact. Attack complexity is genuinely low once an attacker knows or discovers that a route uses Ajv async validators, since the only requirement is to embed a value key in a JSON body. Low privileges (PR:L) are required, which limits mass-exploitation scenarios but still exposes any service where untrusted authenticated users can POST or PUT data. No EPSS score was provided in the input data, and this CVE is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation at this time - even a mid-sized municipal IT team in inowroclaw relying on a Fastify-backed internal API should treat this as urgent if they expose endpoints to lower-trust users, since the schema bypass can be exploited to promote data to handler-visible scope without the schema ever having validated it. The absence of an availability impact (A:N) is consistent with the description, which focuses on confidentiality and integrity. SSVC framing: exploitation status is none/proof-of-concept not yet confirmed; the attack is automatable; technical impact is total on the affected route's data handling.

An authenticated attacker with a low-privilege account on a Fastify-based API sends a POST request to a restricted route. The JSON body is crafted so that the schema-validated object passes validation (e.g., contains expected required fields), but also includes a root-level value property whose content is an object with elevated-privilege data (such as an adminAction: true flag or a different user's record identifier). Fastify replaces the validated body with body.value before the handler runs, causing the handler to process the attacker-supplied inner object - potentially triggering privileged operations or returning data the schema never authorized. No public exploit code has been identified at time of analysis.