fastify vulnerable to request validation bypass via skipped boolean false schemas

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-84469 · Microsoft / collected KEV context

EUVD-2026-70989

GHSA-hwr6-493r-vm6h

cve-program · CVE-2026-84469

• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-70989

• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-84469

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h

osv · GHSA-hwr6-493r-vm6h

• https://github.com/fastify/fastify/security/advisories/GHSA-hwr6-493r-vm6h
• https://nvd.nist.gov/vuln/detail/CVE-2026-84469
• https://github.com/fastify/fastify/commit/7de6e81697778f9f41bd327a3b1c5c9a0d9637b4
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify
• https://github.com/fastify/fastify/releases/tag/v5.12.2

• fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to … · Advisory content revised · 1 Nov 2026