EUVD-2026-70989Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable, no auth required once a false-schema route exists; only integrity impacted as attackers invoke handlers, not exfiltrate data.
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb
Lifecycle Timeline
4DescriptionCVE.org
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.
AnalysisAI
Schema validation bypass in fastify before 5.12.2 allows unauthenticated remote clients to reach route handlers that were explicitly configured to reject all input. When a developer assigns the JSON Schema Draft 7 boolean false as a route's body, querystring, params, or headers schema - a valid pattern meaning 'deny every instance' - fastify evaluates it as JavaScript falsy and skips validator compilation entirely, effectively nullifying the intended deny-all gate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target fastify application (version < 5.12.2) has at least one route where the schema configuration includes a boolean false value for body, querystring, params, or headers (e.g., { schema: { body: false } }). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 7.5) accurately reflects the network-reachability and no-authentication character of this flaw when a vulnerable route exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade fastify to version 5.12.2 or later, which correctly interprets the JSON Schema boolean false as a deny-all validator rather than a missing schema. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all fastify deployments and identify any routes configured with schema false for access control; assess the scope and sensitivity of exposed operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all req
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
Fastify is a fast and low overhead web framework, for Node.js. Rated high severity (CVSS 7.5), this vulnerability is rem
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: a
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger reso
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Authorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthent
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authoriza
Fastify is a web framework with minimal overhead and plugin architecture. Rated high severity (CVSS 8.8), this vulnerabi
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today