CVE-2026-84428

fastify versions before 5.12.2 are vulnerable to a header validation bypass caused by incomplete case normalization in the JSON Schema Draft 7 dependencies keyword. While the library lowercases property keys and the root-level required array to accommodate HTTP's case-insensitive headers, it fail...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

Improper Validation of Unsafe Equivalence in Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input due to incomplete schema case normalization in lib/validation.js when compiling header schemas. An attacker can bypass schema-enforced...

CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +544 more potentially affected by CVE-2026-84428 via fastify (>=5.0.0-alpha.2, <=5.12.1)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.2.7 and more Source cves: CVE-2026-84428 Source advisory: SNYK:JS-FASTIFY-19639042...

03-api-solid (>=1.0.0, <=1.1.2), 0uth (>=1.0.5, <=1.2.1) +4034 more potentially affected by CVE-2026-84428 via fastify (>=0.5.0, <=5.12.1)

fastify NPM version =0.5.0, =1.0.0, =1.0.5, =1.0.0, =1.0.0, =0.0.0, =0.0.1, =1.0.3, =0.0.1, =0.1.66, =0.5.0, =1.3.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2-canary.2 and more Source cves: CVE-2026-84428 Source advisory: MEND:CVE-2026-84428...

CVE-2026-76169

A flaw was found in fastify. Malformed URLs can be routed to a custom not-found handler of a different plugin, bypassing the intended security checks. This allows an unauthenticated attacker to access and read the full response of an authentication-protected private fallback, leading to informati...

CVE-2026-84504

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-85184

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-84469

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

CVE-2026-76169

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...

CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

Improper Validation of Specified Type of Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the route schema handling in lib/route.js, lib/schemas.js, and lib/validation.js. An attacker can reach a route handler with arbitrary...

CVE-2026-84469

fastify versions before 5.12.2 use JavaScript truthiness to decide whether to compile a request schema. Because JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, an application that assigns false to a route's body, querystring, params, or headers schema ...

CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

03-api-solid (>=1.0.0, <=1.1.2), 0uth (>=1.0.5, <=1.2.1) +4034 more potentially affected by CVE-2026-84469 via fastify (>=0.5.0, <=5.12.1)

fastify NPM version =0.5.0, =1.0.0, =1.0.5, =1.0.0, =1.0.0, =0.0.0, =0.0.1, =1.0.3, =0.0.1, =0.1.66, =0.5.0, =1.3.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2-canary.2 and more Source cves: CVE-2026-84469 Source advisory: MEND:CVE-2026-84469...

@agent-tool-platform/agent-kit (>=0.2.0, <=0.4.0), @agent-tool-platform/ast-summarizer (>=0.1.0, <=0.1.1) +544 more potentially affected by CVE-2026-84469 via fastify (>=5.0.0-alpha.2, <=5.12.1)

fastify NPM version =5.0.0-alpha.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.0.4, =0.0.0-vBETA-20260417080530, =0.0.1, =1.60.2, =1.0.0, =0.0.0, =2.0.1, =0.1.0, =0.2.7 and more Source cves: CVE-2026-84469 Source advisory: SNYK:JS-FASTIFY-19639041...

CVE-2026-84504

A flaw was found in fastify. An authenticated low-privilege caller can exploit a vulnerability where the framework incorrectly processes the result of an Ajv asynchronous async validator. If a request body contains a root-level property named 'value', fastify replaces the entire request body with...

CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...