Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-09-04 | 3 | Disclosure2Patch1 |
| 2026-10-01 | 1 | Disclosure1 |
🔴 Fastify, Improper Input Validation, #CVE-2026-84504 (High) -DC-Oct2026-2688 https://dailycve.com/fastify-improper-input-validation-cve-2026-84504-high-dc-oct2026-2688/
Post summary
The post announces a new CVE (CVE-2026-84504) for Fastify involving improper input validation with high severity, linking to a summary page without mentioning exploitation, patches, or PoC.
CVE-2026-84504 fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a req… https://www.cve.org/CVERecord?id=CVE-2026-84504
Post summary
The entry reports a new flaw in Fastify before 5.12.2 involving Ajv async validator handling, providing a concise technical description without mentioning PoC, exploits, or patch availability.
🐛 VULNERABILITIES (CVSS 8.1) CVE-2026-84504: — severity important — Red Hat Security Data (JSON) https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-84504.json #Vulnerability #CVE #ZeroDay
Post summary
Red Hat publicly discloses CVE-2026-84504 with a CVSS score of 8.1 and important severity, providing a link to the official JSON data.
🚨 High-severity security fix in fastify@5.12.2 just released! Patches CVE-2026-84504: request body replacement via an async validation result collision. https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
Post summary
Fastify 5.12.2 released a high‑severity patch for CVE‑2026‑84504, fixing a request body replacement bug caused by async validation result collision.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify | - | node.js | - |