Description

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T10:17:13.677Z",
  "pubdate": "2026-09-04T10:17:13.677Z",
  "executiveSummary": "A critical security vulnerability exists in Fastify versions prior to 5.12.2 involving improper handling of boolean JSON schemas.\nThe vulnerability is classified as an authentication or validation bypass, arising from an incorrect implementation of schema compilation logic.\nSpecifically, when a developer provides the boolean 'false' as a schema for body, querystring, params, or headers to deny all incoming requests, the framework erroneously interprets this as an absence of a schema.\nThis failure causes the application to bypass validation entirely, inadvertently permitting traffic that should have been blocked by the 'deny-all' policy.\nThe impact is severe, as it allows unauthenticated remote attackers to reach restricted route handlers, potentially leading to unauthorized data access, unauthorized state changes, or the execution of disabled operations.\nThe vulnerability is reachable via standard network exposure and requires no specific privileges beyond the ability to send requests to the targeted endpoint.\nRisk is significant, necessitating an immediate upgrade to version 5.12.2 or later to ensure correct enforcement of JSON Schema constraints.",
  "technicalDetails": "The root cause of this vulnerability lies in the internal schema compilation logic within Fastify, which determines whether a validator function should be generated based on the truthiness of the provided schema object.\nAccording to JSON Schema Draft 7, a boolean 'false' is a valid, functional schema that acts as a 'deny-all' constraint, explicitly rejecting every input instance.\nFastify's internal implementation failed to differentiate between a null/undefined schema (which triggers default behavior) and the boolean 'false' (which should trigger a validator that rejects all inputs).\nWhen a developer explicitly sets a route parameter such as 'body', 'querystring', 'params', or 'headers' to 'false', the Fastify compiler evaluates the truthiness of the value. Because 'false' is falsy in JavaScript, the compiler incorrectly determines that no schema has been defined for the route.\nConsequently, the framework skips the compilation of the validator function for those specific inputs, effectively disabling validation for the associated route.\nThe attack flow proceeds as follows: 1) An application developer configures a specific route with a 'false' schema for one or more input vectors, intending to disable access to that route or block all inputs. 2) An unauthenticated remote attacker identifies these endpoints. 3) The attacker sends a crafted request to the endpoint. 4) Fastify processes the request, checks for an associated validator, finds none due to the logic error, and skips the validation phase entirely. 5) The request is passed directly to the route handler, bypassing the intended security controls. 6) The route handler executes as if the input were valid, despite the developer's intent to deny all traffic.\nThis behavior results in a complete validation bypass. In scenarios where developers rely on schema-based access control or input blocking to prevent unauthorized state transitions or the execution of privileged code paths, the attacker can reach these otherwise unreachable functions.\nThe vulnerability exists in all Fastify versions prior to 5.12.2. Exploitation does not require authentication, as the bypass occurs before the application logic that might otherwise handle session verification, and it is accessible over any network protocol supported by the Fastify instance (typically HTTP/HTTPS).\nPost-exploitation, the impact is limited only by the permissions of the underlying route handler, potentially allowing for arbitrary unauthorized operations or data exfiltration depending on the handler's design."
}