CVE-2026-84469

Executive Summary

CVE-2026-84469 is a schema-validation bypass in the Fastify Node.js web framework affecting all versions before 5.12.2. Fastify evaluates whether to compile a request schema using JavaScript truthiness, so a route that sets false on body, querystring, params, or headers — a technically valid JSON Schema Draft 7 construct meaning "reject every instance" — is misinterpreted as "no schema supplied." Fastify therefore skips validator compilation and routes any request straight to the handler. An unauthenticated remote attacker can invoke endpoints the developer intended to be entirely unreachable, enabling unauthorized state changes or execution of disabled operations (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, integrity-only impact). EPSS is 0.00283 (20.9th percentile); no public PoC, Nuclei template, or KEV listing is currently known.

Technical Analysis

The defect is a type-confusion-adjacent logic error between two specifications: JavaScript's truthiness model and JSON Schema Draft 7's definition of a boolean schema. In Draft 7, a schema may be the boolean literal true (accept every instance) or false (reject every instance). Fastify's route-option processing, however, treats schema-bearing options as conditionally compilable based on whether the value is truthy. Because false is falsy in JavaScript, a route declared with a deny-all schema such as a body or querystring value of false is handled as though the schema key were absent or undefined.

The consequence is that no validator is generated for that request segment. Fastify's request lifecycle proceeds as if the route has no constraints on the affected segment, and the route handler executes for any matching incoming request. This is a complete validation bypass: the intended security control — a schema literally designed to reject all input — is silently removed at route-registration time rather than at request time. The bypass is deterministic, requires no malformed payload, and is not dependent on content-type confusion, parameter pollution, or encoding tricks. Simply sending a normally-formed request to the affected route reaches the handler.

Attack surface and prerequisites:

• Deployment: the application must run Fastify < 5.12.2.
• Configuration: at least one route must deliberately use the boolean false as a body, querystring, params, or headers schema — a documented pattern for disabling input on an endpoint (e.g., an internal health-trigger, a maintenance toggle, or a state-changing route exposed but intended to be locked).
• Exposure: the route must be network-reachable, and any authentication or authorization previously gated behind schema rejection is now ineffective for that segment.
• Impact scope: integrity only per the CVSS vector (I:H, C:N, A:N). Confidentiality and availability are not scored, but the narrative permits "unauthorized state changes or execution of disabled operations."

The root cause is narrow and clean: Fastify fails to distinguish "schema absent" from "schema present and equal to the boolean false." A correct implementation must check for the presence of the key and validate it as a JSON Schema (including boolean schemas), not coerce it via truthiness. The fix in 5.12.2 is to compile false into a validator that rejects every instance, restoring the developer's deny-all intent.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The chain below is inferred strictly from the vulnerability class and the NVD description; no function names, endpoints, or parameters beyond those in the advisory are assumed.

1. Reconnaissance / target identification. The attacker enumerates hosts and applications served by Fastify. Fingerprinting is possible through framework-typical response headers, default error pages, or behavioral quirks; Shodan/censys searches for Fastify-served services narrow the candidate set. The attacker then seeks routes whose behavior suggests a security control was intended but is not enforced — for example, endpoints that respond identically to arbitrary input or that trigger state changes without any validation error ever being emitted.

2. Triggering the flaw class. The flaw is configuration-triggered, not payload-triggered. On a vulnerable deployment, a route whose body, querystring, params, or headers schema is the boolean false has had its validator silently dropped. The attacker sends a request to that route in the segment(s) that should have been denied. Because no validator was compiled, the request is not rejected by schema enforcement; it passes straight into the handler. No malformed syntax, no injection string, and no parser abuse is required — the mere existence of the request satisfies the route.

3. Payload / execution at the vulnerability-class level. This is a validation-bypass class (CWE-20). The "payload" is simply a well-formed request to the protected route. Where a deny-all schema was the only barrier, the handler now executes for the unauthenticated client. If the developer also used schema rejection as a surrogate for authorization on operations such as administrative toggles, forced state transitions, or "disabled" code paths, the attacker can execute those operations. The specific request shape cannot be enumerated without the target application's route definitions and is therefore deliberately left unstated.

4. Post-exploitation impact. Successful invocation of the previously unreachable handler can cause unauthorized state changes or activation of operations the developer intended to disable (per the advisory). Given integrity-only CVSS scoring, the primary risk is manipulated application state — configuration changes, workflow transitions, resource mutations — rather than direct data disclosure or denial of service. Secondary impact depends entirely on what the unlocked handler does: if it exposes a privileged action, compromise may extend further through that action's own permissions rather than through Fastify itself.

Impact Assessment

• CVSS 3.1: 7.5 (High) — AV:N (remotely reachable), AC:L (no special conditions; the flaw is configuration-triggered but deterministic), PR:N (unauthenticated), UI:N (no user interaction), S:U (impact stays within the vulnerable component's security authority), C:N (no direct confidentiality impact), I:H (high integrity impact — handlers can alter state), A:N (no availability impact).
• Business impact: Applications that rely on deny-all schemas as a defense-in-depth control lose that control entirely. The most serious outcomes are unauthorized modification of application state and exposure of internal or "disabled" operations. If an unreachable handler performs privileged business actions (billing adjustments, account state flips, feature toggles, administrative triggers), the blast radius can be large even though CVSS does not score confidentiality or availability.
• Affected systems: Any Fastify < 5.12.2 deployment where a route uses boolean false for body, querystring, params, or headers. This includes Node.js microservices, API gateways, and serverless functions built on Fastify. Exposure is limited to internet-facing routes that are network-reachable; purely internal-only routes below the DMZ remain exploitable only by attackers already on the internal network.
• Likelihood: EPSS 0.00283 (20.9th percentile) indicates low observed exploitation to date; no KEV listing, no PoC, and no nuclei template. However, because the bypass requires no payload, weaponization cost is essentially zero once a vulnerable route is identified, and exploitation is quiet — no validation errors are returned.
• Blast radius considerations: The flaw itself is per-route. An application that never uses boolean false schemas is not exploitable even while running a vulnerable version. Organizations must inventory route schemas, not just Fastify versions, to determine true exposure.

Detection Guidance

Detection focuses on identifying requests reaching handlers that should have been denied, and on anomaly signals around route behavior after upgrade. Because the bypass emits no malformed input, network signatures must target behavioral anomalies rather than payload patterns.

Sigma Rule

title: Fastify Deny-All Schema Bypass - Unvalidated Request to Protected Route (CVE-2026-84469)
id: 9f3a7c2e-4b1d-4f8e-9c6a-2d5e8f1a7b3c
status: experimental
description: Detects requests to Fastify routes configured with a boolean false deny-all schema where the handler was invoked without schema validation. Correlation/log-based heuristic for CVE-2026-84469.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84469
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.84469
logsource:
  category: webserver
  product: fastify
detection:
  selection_route:
    http.method:
      - GET
      - POST
      - PUT
      - PATCH
      - DELETE
  selection_no_validation:
    fastify.validation.compiled: false
  selection_status:
    http.response.status_code:
      - 200
      - 201
      - 202
      - 204
  condition: selection_route and selection_no_validation and selection_status
fields:
  - clientip
  - http.method
  - url.path
  - http.response.status_code
falsepositives:
  - Routes legitimately declared without any schema
  - Logging gaps in framework instrumentation
level: high

YARA Rule

rule CVE_2026_84469_Fastify_DenyAll_Schema_Bypass
{
    meta:
        author      = "valtersit.com Threat Intelligence"
        description = "Detects Fastify deny-all boolean schema pattern susceptible to validation bypass (CVE-2026-84469)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-84469"
        date        = "2026-01-01"
        cve         = "CVE-2026-84469"

    strings:
        $fastify_pkg   = "fastify" ascii nocase
        $kw_body       = "schema" ascii nocase
        $kw_false_body = "body" ascii nocase
        $kw_false_qs   = "querystring" ascii nocase
        $kw_false_par  = "params" ascii nocase
        $kw_false_hdr  = "headers" ascii nocase
        $bool_false    = ": false" ascii

    condition:
        $fastify_pkg and
        filesize < 5MB and
        $kw_body and
        ($kw_false_body or $kw_false_qs or $kw_false_par or $kw_false_hdr) and
        $bool_false
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84469 Potential Fastify Deny-All Schema Bypass - Unvalidated Request to Protected Route"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Fastify"; nocase; reference:cve,2026-84469; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84469; classtype:attempted-access; sid:90084469; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Medium;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http" and http.request.method in ("GET","POST","PUT","PATCH","DELETE") ]
  [ http where http.response.status_code in (200,201,202,204)
      and http.request.body.content : "*"
      and not event.category == "intrusion_detection"
      and rule.name : "*Deny-All*" ]

Splunk SPL Query

index=web sourcetype=fastify OR sourcetype=web_application
| eval validation_state = coalesce(fastify_validation_compiled, "unknown")
| search (validation_state="false" OR validation_state="unknown")
| where status IN (200, 201, 202, 204)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths
        by src_ip, http_method
| where count >= 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Note: if the deployment's logs do not carry a fastify_validation_compiled field, correlate handler-invocation logs against the route inventory of deny-all endpoints and alert on any hit. The SPL above is structured to degrade gracefully to that fallback.

Wazuh OSSEC Rule

<group name="web,fastify,cve-2026-84469,">
  <rule id="100469" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.method">\.+</field>
    <field name="fastify.validation.compiled">false</field>
    <field name="http.response.status_code">^(200|201|202|204)$</field>
    <description>CVE-2026-84469: Fastify handler invoked without compiled validator on deny-all schema route</description>
    <options>no_full_log</options>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix; sources: NVD, OSV).

1) Immediate mitigations (if upgrade cannot be applied at once):

• Inventory all Fastify routes and identify any that use boolean false for body, querystring, params, or headers. These are the only exploitable routes under this CVE.
• For each such route, replace the boolean false schema with an equivalent object schema that rejects all instances in a way the vulnerable version still enforces — for example, a schema requiring a property that clients cannot supply, or a schema with a constraint that no request can satisfy. The objective is to remove reliance on the framework's truthiness bug.
• Where a route is not actually required, remove it or return an explicit 4xx/5xx at the handler boundary.
• Place compensating controls in front of affected endpoints (reverse-proxy ACLs, WAF rules blocking unauthenticated access, network segmentation) so the handler is unreachable even if the framework skips validation.
• Add handler-level authorization checks so security does not depend solely on schema rejection.

2) Patch / upgrade steps:

• Upgrade Fastify to 5.12.2 or later (the fixed release named in the advisory).
• Update package.json dependency constraints and run the package manager lockfile refresh; verify the resolved version with npm ls fastify.
• Re-deploy and, in staging, confirm that routes with boolean false schemas now return validation rejections for arbitrary input.
• Treat transitive dependents of Fastify (frameworks and plugins wrapping it) as in-scope; verify the effective Fastify version in the packaged build.

3) Long-term hardening:

• Add dependency monitoring to flag frameworks with known validation/authorization bypass classes, not just direct-CVE matches against the top-level package.
• Encode the principle that schema rejection is input validation, not authorization — never use a deny-all schema as the sole gate for privileged operations.
• Add regression tests that assert deny-all routes reject all input, so future spec/implementation mismatches fail CI.
• Adopt a formal JSON Schema conformance check (including boolean schemas) in the framework's route-registration tests.
• Maintain an accurate route inventory for internet-facing services to enable fast, targeted exposure assessment when a framework CVE lands.

References

1. NVD — CVE-2026-84469: https://nvd.nist.gov/vuln/detail/CVE-2026-84469
2. OSV Advisory entry for fastify (patched in 5.12.2): https://osv.dev/ (search CVE-2026-84469)
3. Fastify project release 5.12.2 (fix version per NVD/OSV) — upstream changelog and repository releases
4. JSON Schema Draft 7 specification — boolean schema semantics (false rejects every instance): https://json-schema.org/specification-links#draft-7
5. CISA Known Exploited Vulnerabilities catalog: not listed for CVE-2026-84469 as of this report; no known threat-actor campaign or exploit-in-the-wild evidence is documented in the provided data (EPSS 0.00283, no PoC, no Nuclei template, no KEV entry).