Read the docs
TI-2026-58050 Aliases CVE-2026-84469GHSA-hwr6-493r-vm6h

fastify vulnerable to request validation bypass via skipped boolean false schemas

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00492 42nd percentileScored 2026-11-07
Fix Partial fastify (fastify): 5.12.2fastify (npm): 5.12.2Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastifyfastifybefore 5.12.25.12.2Patch availableCNA
—fastify (npm)before 5.12.25.12.2Patch availableGHSA-hwr6-493r-vm6h
  • fastify Vendorfastify Affected before 5.12.2 Fixed in 5.12.2 Patch available CNA
  • fastify (npm) Vendor— Affected before 5.12.2 Fixed in 5.12.2 Patch available GHSA-hwr6-493r-vm6h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*before 5.12.2Vulnerablefastify
  • cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:* Versions before 5.12.2 Vulnerable ·fastify

Remediation

  • Fix · CNA fastify (fastify) Fixed in 5.12.2
  • Fix · GHSA-hwr6-493r-vm6h fastify (npm) Fixed in 5.12.2 Advisory →

Red Hat 4 advisories

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
Show 1 more Red Hat advisories
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    fastify 5.12.2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-58022 fastify vulnerable to header validation bypass via incomplete schema case normalizationPriority LOW 39
    • TI-2026-53284 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlersPriority LOW 39
    • TI-2026-58072 fastify vulnerable to request body replacement via an async validation result collisionPriority LOW 38
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Not affected: 4 products
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Dev Spaces 3.31

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84469
  2. 2026-10-03 Alias added: GHSA-hwr6-493r-vm6h
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  6. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  7. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  8. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat

References

Advisory 3

Other 3

  • TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
  • TI-2025-23513 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass CVSS 3.1HIGH 7.5
  • TI-2026-58022 fastify vulnerable to header validation bypass via incomplete schema case normalization CVSS 3.1HIGH 7.5
  • TI-2026-53284 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVSS 3.1HIGH 7.5
  • TI-2026-26178 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header CVSS 3.1HIGH 7.5
  • TI-2026-58072 fastify vulnerable to request body replacement via an async validation result collision CVSS 3.1HIGH 8.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences