CVE-2026-84504

Fastify versions before 5.12.2 misinterpret the object resolved by a successful Ajv async validator as the value-result protocol used by custom validator compilers, which is an input validation flaw (CWE-20). The flaw is triggered when an authenticated request passes its route schema but contains a property named 'value' at the root of the body: Fastify then replaces the entire validated request body with that property's value before the handler executes. An authenticated low-privilege attacker can exploit this to make the handler operate on nested, effectively unvalidated data, achieving unauthorized state changes and data disclosure on routes the schema was supposed to protect. Any Fastify application running a version before 5.12.2 that uses Ajv async validation and accepts request bodies with a root-level 'value' property is affected. There is no known public proof of concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.4% (32nd percentile), indicating low observed exploitation risk so far.

What to do: Upgrade to fastify 5.12.2 or later. As an interim mitigation, avoid accepting request bodies with a root-level 'value' property on routes using Ajv async validation, and audit such routes for handlers that make authorization or state-change decisions based on the body's structure. Because no exploitation is observed yet, prioritize patching internet-facing Fastify APIs that accept untrusted authenticated input.