CVE-2026-84504

[CVE catalog]

Severity

High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Published

Sep 4, 2026, 9:40:18 AM UTC

Updated

Sep 4, 2026, 10:17:13 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.43% · Oct 25, 2026

A flaw was found in fastify. An authenticated low-privilege caller can exploit a vulnerability where the framework incorrectly processes the result of an Ajv asynchronous (async) validator. If a request body contains a root-level property named 'value', fastify replaces the entire request body with this property's content, bypassing the intended schema validation. This can lead to unauthorized state changes and the disclosure of sensitive data, as the application handler receives an unvalidated object. fastify: fastify: Unauthorized state changes and data disclosure via request body replacement This Important flaw in fastify allows an authenticated low-privilege user to bypass schema validation. By injecting a 'value' property into the request body, an attacker can trigger unauthorized state changes and data disclosure, impacting the integrity and confidentiality of data in affected Red Hat OpenShift AI and Red Hat OpenShift Dev Spaces deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.