fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness

CVE-2026-84469 (GHSA-hwr6-493r-vm6h) affects Fastify < 5.12.2 (and pre-6.0.0 on the v6 branch). Fastify's route-schema compilation path uses a JavaScript truthiness check to decide whether a schema needs compiling. JSON Schema Draft 7 says the boolean value false is a valid schema meaning *reject every instance* — but false is falsy in JS, so Fastify silently skips compilation. Any route that declares schema: { body: false } or schema: { querystring: false } intending to block all input instead allows any input through to the handler, completely unvalidated.

The vendor rates this HIGH / 7.5 with an unauthenticated-network vector, but that score assumes every Fastify deployment is affected. It isn't. The boolean false schema is an obscure JSON Schema Draft 7 idiom; the overwhelming majority of Fastify routes use object or array schemas ({ type: 'object', properties: {…} }) which are truthy and compile normally. You have to *actively choose* the rare false-as-schema pattern to be vulnerable. When that precondition is met the bypass is real and complete, but the population of affected apps is narrow enough that the vendor score overstates fleet-wide risk.

Why this verdict

• Narrow precondition drastically limits population. The vulnerability only fires when a developer uses false as a schema value — an obscure JSON Schema Draft 7 idiom. The typical Fastify route uses { type: 'object', properties: {…} }, which is truthy and compiles correctly. This is not a universal bypass.
• Impact is conditional, not guaranteed. Even when the bypass triggers, the handler must also lack defense-in-depth (parameterized queries, manual type checks, ORM escaping) for the attacker to chain into a meaningful exploit like injection.
• Role multiplier: Fastify is a general-purpose web framework, not a canonical high-value-role component. It is not a hypervisor, IdP, domain controller, PAM, or security agent. In its most sensitive deployment role — an API gateway — the boolean-false schema pattern is plausible but still uncommon. The blast radius of a successful exploit is limited to the specific route and its downstream operations (host or tenant scope at worst), not fleet-scale or domain-scale compromise.
• No exploitation in the wild, no KEV listing, no public weaponized tooling. The PoC is trivial but useless without a target app that uses the specific code pattern.

Why not higher?

To justify HIGH, we would need the affected pattern to be common across Fastify deployments or the impact to be guaranteed (e.g., direct RCE). Neither applies: boolean false schemas are rare, and the downstream impact is entirely dependent on handler logic. There is no evidence of in-the-wild exploitation, and Fastify is not a canonical high-value-role component where a validation bypass auto-escalates to fleet compromise.

Why not lower?

The vulnerability is real, trivially exploitable when the precondition is met, and reachable by an unauthenticated remote attacker over the network with no user interaction. A complete schema validation bypass on a production API route *can* lead to serious injection chains if the handler is not independently hardened. Dismissing it as LOW would understate the risk for the minority of apps that do use this pattern.

1. Replace boolean false schemas with { "not": {} } — This is the advisory's recommended workaround. { "not": {} } is truthy in JavaScript so Fastify compiles it, and it is semantically equivalent to false in JSON Schema — it rejects all instances. Apply this find-and-replace across your codebase immediately. No mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window.
2. Add a semgrep or ESLint rule to flag boolean schema values — Write a static analysis rule that detects schema: { body: false } (and querystring, params, headers variants) in route definitions. Run it in CI to prevent regression. Example semgrep pattern: pattern: 'schema: { body: false }'.
3. Upgrade to Fastify 5.12.2 or 6.0.0 — The definitive fix. The patch changes schema selection from a truthiness check to explicit presence detection (!== undefined). This is the remediation action within the 365-day noisgate remediation SLA.
4. Ensure handlers practice defense-in-depth — Even with schema validation, handlers should use parameterized queries, ORM escaping, and explicit type checks. This limits the blast radius of any validation bypass.

Run this on any host with node (v18+) and network access to your source repositories. It scans your Fastify project directories for boolean false schema usage AND checks the installed Fastify version. Invoke with: bash check_cve_2026_84469.sh /path/to/your/fastify/project. No special privileges required.

#!/usr/bin/env bash
# check_cve_2026_84469.sh — CVE-2026-84469 Boolean False Schema Bypass
# Usage: bash check_cve_2026_84469.sh /path/to/fastify/project
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"
RESULT="UNKNOWN"

if [ ! -d "$PROJECT_DIR" ]; then
  echo "ERROR: Directory $PROJECT_DIR does not exist."
  exit 2
fi

# Check installed Fastify version
PKG_JSON="$PROJECT_DIR/node_modules/fastify/package.json"
if [ ! -f "$PKG_JSON" ]; then
  echo "WARNING: fastify not found in node_modules. Checking package.json only."
  if [ -f "$PROJECT_DIR/package.json" ]; then
    DECLARED=$(grep -oP '"fastify"\s*:\s*"\K[^"]+' "$PROJECT_DIR/package.json" 2>/dev/null || echo "")
    echo "Declared fastify version constraint: ${DECLARED:-not found}"
  fi
  echo "UNKNOWN — cannot determine installed version."
  exit 2
fi

VERSION=$(node -e "console.log(require('$PKG_JSON').version)" 2>/dev/null || echo "")
if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse fastify version."
  exit 2
fi

echo "Installed Fastify version: $VERSION"

# Compare version — vulnerable if < 5.12.2 (on v5 branch) or < 6.0.0 (on v6 branch)
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

VULN_VERSION=false
if [ "$MAJOR" -lt 5 ]; then
  VULN_VERSION=true
elif [ "$MAJOR" -eq 5 ]; then
  if [ "$MINOR" -lt 12 ]; then
    VULN_VERSION=true
  elif [ "$MINOR" -eq 12 ] && [ "$PATCH" -lt 2 ]; then
    VULN_VERSION=true
  fi
fi

# Check for boolean false schema usage in source files
echo ""
echo "Scanning for boolean false schema patterns..."
FALSE_HITS=$(grep -rn --include='*.js' --include='*.ts' --include='*.mjs' --include='*.cjs' \
  -E '(body|querystring|query|params|headers)\s*:\s*false' "$PROJECT_DIR/src" "$PROJECT_DIR/lib" "$PROJECT_DIR/routes" "$PROJECT_DIR/app" 2>/dev/null || echo "")

if [ -n "$FALSE_HITS" ]; then
  echo "WARNING: Found potential boolean false schema usage:"
  echo "$FALSE_HITS"
  USES_FALSE=true
else
  echo "No boolean false schema patterns detected in common source directories."
  USES_FALSE=false
fi

echo ""
if [ "$VULN_VERSION" = true ]; then
  if [ "$USES_FALSE" = true ]; then
    echo "VULNERABLE — Fastify $VERSION is affected AND boolean false schemas detected."
    exit 1
  else
    echo "VULNERABLE — Fastify $VERSION is affected (but no boolean false schema usage detected — lower risk)."
    exit 1
  fi
else
  echo "PATCHED — Fastify $VERSION is not affected by CVE-2026-84469."
  exit 0
fi

Sources

1. GHSA-hwr6-493r-vm6h — Fastify Boolean False Schema Bypass Advisory
2. Fastify Validation and Serialization Documentation
3. CVE-2026-18504 — Related Fastify Schema Validation Bypass
4. CVE-2026-33806 — Fastify Body Schema Validation Bypass via Content-Type
5. Fastify CVE List — CVEDetails
6. Fastify npm Package Health & Stats
7. Fastify GitHub Security Overview