---
id: CVE-2026-84504
title: >-
  fastify versions before 5.12.2 treat the object resolved by a successful Ajv
  async validator as the value result protocol used by custom validator
  compilers
summary: >-
  fastify versions before 5.12.2 treat the object resolved by a successful Ajv
  async validator as the value result protocol used by custom validator
  compilers. If a request that passes its route schema contains a property named
  value at th…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-20
  - CWE-179
vendor: fastify
product: fastify
affected:
  - fastify < 5.12.2
patched:
  - fastify 5.12.2
published: '2026-09-04'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T20:05:15.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84504'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: 'https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84504.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-84504'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2528450'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-84504'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84504'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00399
epssPercentile: 0.33998
ingestedAt: '2026-09-08T19:08:49.592Z'
---

## Overview

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.

## Affected

- `fastify < 5.12.2`

## Remediation

Upgrade past the affected range:

- `fastify 5.12.2`

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84504.json)