CVE-2026-84469

Fastify versions before 5.12.2 use JavaScript truthiness to decide whether to compile a request schema, so the JSON Schema boolean false, which Draft 7 defines as a valid schema that rejects every instance, is treated as if no schema were configured. When an application sets false as a route's body, querystring, params, or headers schema to deny all input, fastify compiles no validator and runs the route handler on any request. An unauthenticated remote attacker can therefore reach handlers that the deny-all schema was intended to make unreachable, potentially causing unauthorized state changes or executing operations that were supposed to be disabled (integrity-only impact per the CVSS score). Any fastify-based application on an affected version that uses boolean false schemas is exposed; the real-world impact depends on what those handlers do. No public proof of concept is known, the flaw is not in CISA KEV, and EPSS currently estimates a 0.3% probability of exploitation within 30 days, indicating no known exploitation at this time.

What to do: Upgrade fastify to 5.12.2 or later. Audit route definitions for boolean false used as the body, querystring, params, or headers schema, and verify whether any resulting handlers are reachable without authentication; as an interim mitigation, replace false with an always-rejecting JSON Schema or add explicit validation before invoking the handler.