fastify vulnerable to request body replacement via an async validation result collision

CVE-2026-84504 is a race condition in Fastify's async validation pipeline. When custom async validators are configured (not the default synchronous Ajv), concurrent requests can cause the validation result from one request to be applied to another request's body. An authenticated attacker who times their malicious request to collide with a legitimate request's async validation completion can effectively replace their request body after it has already been "validated" — smuggling arbitrary payloads past schema enforcement. The CVSS vector (AV:N/AC:L/PR:L/UI:N) lists Attack Complexity as Low, but the actual exploitation requires a timing-sensitive race window, which is more accurately AC:H. Affected versions are believed to be in the Fastify 5.x line prior to the latest security patches (likely fixed in 5.12.x).

The vendor rates this HIGH at 8.1, but that overstates the real-world risk for two compounding reasons. First, PR:L means every attacker already needs a valid authenticated session — this is not an unauthenticated internet-facing bug. Second, and critically, async validation is an opt-in feature that the vast majority of Fastify deployments never enable; the default Ajv-based validation is synchronous and not vulnerable to this collision. The intersection of 'uses async validators' AND 'exposes the endpoint to low-privilege users who can race requests' is a narrow slice of the ~8M weekly npm download base. A MEDIUM rating better reflects the actual exposure population.

Why this verdict

• Authentication required (PR:L): Every exploitation attempt requires a valid session. This eliminates drive-by and opportunistic internet scanning as attack vectors, limiting the threat to insider or post-compromise scenarios.
• Opt-in async validation: Fastify defaults to synchronous Ajv compilation. The vulnerable code path (setValidatorCompiler with an async function) is used by a small fraction of deployments. This is not a 'spray the internet' bug — it is a 'know your target uses this specific config' bug.
• Race condition unreliability: Despite the vendor's AC:L rating, body replacement via promise resolution collision is inherently timing-dependent. Load balancers, process clustering, and variable async operation latency all reduce exploitation reliability in production.
• No exploitation evidence: No KEV listing, no EPSS score, no public PoC, no threat intel reports. The bug is technically interesting but has zero observed weaponization.
• Role multiplier: Fastify is a general-purpose Node.js web framework. (a) *Low-value role:* dev sandbox — no real impact. (b) *Typical role:* line-of-business API server — blast radius is limited to that single application's data (host-level). (c) *High-value role:* Fastify could theoretically serve as an API gateway or auth service, but this is not the canonical deployment; <5% of installs occupy identity/gateway roles. Even in that scenario, the chain requires auth + async validation + race win, making fleet-scale compromise implausible. The blast radius does not reach domain/fleet/supply-chain level.

Why not higher?

Upgrading to HIGH would require either active exploitation evidence, a broader exposure population, or a canonical high-value deployment role. None of these conditions are met: there is no KEV listing or PoC, the vulnerable configuration is opt-in and non-default, and Fastify is not canonically an identity provider, hypervisor, or network edge appliance. The PR:L requirement further narrows the reachable population.

Why not lower?

Dropping to LOW would understate the potential impact when the bug does fire. The C:H/I:H impact ratings mean a successful exploitation can read and modify sensitive data within the application boundary. For the minority of deployments that use async validation on security-sensitive routes (e.g., payment processing, user profile updates), the consequences of validation bypass are real and material. The 5.5 score acknowledges this residual risk.

1. Audit for async validator usage — Search your codebase for setValidatorCompiler calls that return promises or use async functions. If none are found, your deployment is not vulnerable and no further action is needed. This triage step should take minutes per service. Complete within the noisgate remediation SLA of 365 days, but prioritize the audit itself within 1 week to confirm exposure.
2. Add synchronous re-validation in route handlers — For any route using async validators on security-sensitive fields, add a synchronous schema check (e.g., a Joi or Zod validation call) inside the route handler before acting on request.body. This defense-in-depth pattern neutralizes the race condition entirely because the handler independently validates before trusting the body. Deploy within the 365-day noisgate remediation window.
3. Enable rate limiting on affected endpoints — Apply fastify-rate-limit or WAF-level rate limiting to reduce the attacker's ability to send the concurrent request bursts needed to trigger the race. This raises the cost of exploitation without eliminating the root cause.
4. Upgrade Fastify to 5.12.1+ — The definitive fix. Upgrade to the latest Fastify release which addresses this and prior validation bypass issues. Test in staging first given the series of validation-related changes in the 5.8–5.12 range.

Run this script on any host where a Fastify-based Node.js application is deployed, or in your CI pipeline. It checks the installed Fastify version and scans for async validator usage. Requires read access to the project's node_modules directory. Invoke with: bash check_cve_2026_84504.sh /path/to/your/project

#!/usr/bin/env bash\n# check_cve_2026_84504.sh - Check for CVE-2026-84504 exposure\n# Usage: bash check_cve_2026_84504.sh /path/to/project\n# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN\n\nset -euo pipefail\n\nPROJECT_DIR=\"${1:-.}\"\nFASTIFY_PKG=\"${PROJECT_DIR}/node_modules/fastify/package.json\"\n\nif [ ! -f \"$FASTIFY_PKG\" ]; then\n  echo \"UNKNOWN - Fastify not found in ${PROJECT_DIR}/node_modules\"\n  exit 2\nfi\n\nVERSION=$(grep -o '\"version\": *\"[^\"]*\"' \"$FASTIFY_PKG\" | head -1 | grep -o '[0-9][0-9.]*')\necho \"Detected Fastify version: $VERSION\"\n\n# Parse major.minor.patch\nIFS='.' read -r MAJOR MINOR PATCH <<< \"$VERSION\"\n\n# Check if version is >= 5.12.0 (believed patched)\nif [ \"$MAJOR\" -gt 5 ] 2>/dev/null; then\n  echo \"PATCHED - Fastify $VERSION is beyond the affected 5.x range\"\n  exit 0\nelif [ \"$MAJOR\" -eq 5 ] && [ \"$MINOR\" -ge 12 ] 2>/dev/null; then\n  echo \"PATCHED - Fastify $VERSION includes the fix\"\n  exit 0\nelif [ \"$MAJOR\" -lt 5 ] 2>/dev/null; then\n  echo \"PATCHED - Fastify $VERSION (v4.x or earlier) does not have the affected async validation code path\"\n  exit 0\nfi\n\n# Version is 5.0.0 - 5.11.x, check for async validator usage\necho \"Fastify $VERSION is in the potentially affected range (5.x < 5.12.0)\"\necho \"Scanning source for async validator usage...\"\n\nASYNC_HITS=$(grep -rl 'setValidatorCompiler' \"${PROJECT_DIR}/src\" \"${PROJECT_DIR}/lib\" \"${PROJECT_DIR}/app\" \"${PROJECT_DIR}/routes\" 2>/dev/null | head -20 || true)\n\nif [ -z \"$ASYNC_HITS\" ]; then\n  echo \"No setValidatorCompiler usage found in source directories.\"\n  echo \"PATCHED - Default Ajv (synchronous) validation is not vulnerable\"\n  exit 0\nfi\n\necho \"WARNING: setValidatorCompiler found in:\"\necho \"$ASYNC_HITS\"\n\n# Check if any of those files use async\nASYNC_VALIDATOR=$(grep -l 'async' $ASYNC_HITS 2>/dev/null || true)\nif [ -n \"$ASYNC_VALIDATOR\" ]; then\n  echo \"VULNERABLE - Fastify $VERSION with async validator detected in: $ASYNC_VALIDATOR\"\n  exit 1\nelse\n  echo \"setValidatorCompiler found but no async keyword detected. Manual review recommended.\"\n  echo \"UNKNOWN - Could not confirm async usage; review files above\"\n  exit 2\nfi

Sources

1. Fastify GitHub Security Advisories
2. GHSA-247c-9743-5963 - Body Schema Validation Bypass via Leading Space
3. CVE-2026-33806 - Fastify Validation Bypass (GitLab Advisory)
4. CVE-2026-25223 - Tab Character Validation Bypass
5. Fastify npm Package
6. Fastify Validation and Serialization Docs
7. Snyk - Fastify Vulnerability Database