CVE-2026-84469

[CVE catalog]

A flaw was found in fastify. An unauthenticated remote attacker can bypass request validation by exploiting how fastify processes boolean false schemas. When an application intends to deny all input by assigning 'false' to a route's schema, fastify incorrectly treats it as a missing schema and fails to compile a validator. This allows the attacker to reach handlers that should be unreachable, leading to unauthorized state changes or the execution of disabled operations. fastify: Fastify: Request validation bypass allows unauthorized operations This vulnerability is rated as Important because it allows an unauthenticated remote attacker to bypass intended request validation in applications using Fastify. This bypass occurs when a `false` boolean is used as a schema to deny input, leading to the execution of otherwise unreachable route handlers. This could result in unauthorized operations or state changes within affected Red Hat OpenShift AI, Red Hat Enterprise Linux AI, and Red Hat OpenShift Dev Spaces deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Published

Sep 4, 2026, 9:59:36 AM UTC

Updated

Sep 4, 2026, 10:17:13 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.49% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "fastify",
      "ranges": [
        {
          "fixed": "5.12.2",
          "introduced": "",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84469",
      "fixed_version": "5.12.2",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-84469",
      "provider_updated_at": "2026-09-15T20:06:50.543"
    },
    {
      "name": "fastify",
      "ecosystem": "npm",
      "provider_url": "https://github.com/advisories/GHSA-hwr6-493r-vm6h",
      "fixed_version": "5.12.2",
      "provider_source": "github",
      "provider_record_id": "GHSA-HWR6-493R-VM6H",
      "provider_updated_at": "2026-09-30T23:44:59Z"
    }
  ]
}