---
id: CVE-2026-84504
title: >-
  fastify versions before 5.12.2 treat the object resolved by a successful Ajv
  async validator as the value result protocol used by custom validator
  compilers
summary: >-
  fastify versions before 5.12.2 treat the object resolved by a successful Ajv
  async validator as the value result protocol used by custom validator
  compilers. If a request that passes its route schema contains a property named
  value at th…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-20
  - CWE-179
vendor: fastify
product: fastify
affected:
  - fastify < 5.12.2
patched:
  - fastify 5.12.2
published: '2026-09-04'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T20:05:15.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84504'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: 'https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84504.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-84504'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2528450'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-84504'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84504'
  - url: >-
      https://github.com/fastify/fastify/commit/f02d8d4ab1ab208f10819c4dc213595b06497833
  - url: 'https://github.com/fastify/fastify/releases/tag/v5.12.2'
  - url: 'https://github.com/advisories/GHSA-667r-xxjv-c9mm'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84734'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00428
epssPercentile: 0.36912
ingestedAt: '2026-09-08T19:08:49.592Z'
aliases:
  - GHSA-667r-xxjv-c9mm
ecosystem: npm
---

## Overview

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.

## Affected

- `fastify < 5.12.2`

## Remediation

Upgrade past the affected range:

- `fastify 5.12.2`

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84504.json)
- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)

## Package advisory (CVE-2026-84504)

Affected packages:

- `fastify < 5.12.2`

Patched in:

- `fastify 5.12.2`

Source: https://github.com/advisories/GHSA-667r-xxjv-c9mm