Description

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-04T10:17:13.790Z",
  "pubdate": "2026-09-04T10:17:13.790Z",
  "executiveSummary": "This vulnerability involves an improper handling of the return value from Ajv async validators within Fastify, specifically when processing custom validator compilers. The flaw allows an attacker to inject a specific property, 'value', into the request body to manipulate the data passed to the route handler.\nBy crafting a payload that conforms to the route schema but includes a root-level 'value' property, an attacker can trigger a mechanism where Fastify inadvertently replaces the validated request body with the contents of that specific property. This effectively bypasses the integrity of the schema validation performed before the handler execution.\nThe vulnerability affects Fastify versions prior to 5.12.2. It poses a significant security risk, as authenticated low-privilege users can perform unauthorized state changes or achieve unauthorized data disclosure by substituting validated request data with arbitrary, nested structures. This results in the handler operating on data that has not been correctly sanitized or restricted by the intended route schema, leading to potential privilege escalation or data corruption within the application state.\nSuccessful exploitation requires the attacker to be authenticated, although the impact can be severe depending on the authorization logic of the target route.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic used to process results from custom validator compilers within Fastify. When an Ajv async validator successfully validates a request, Fastify interprets the resolved object based on a specific result protocol. If the validated object contains a property named 'value' at the root, the internal processing engine treats this property as the final payload for the request body.\nIn standard operation, Fastify uses the result of the validator as the validated body. However, because of the flawed implementation of the result protocol, if a client submits a payload containing a 'value' property, the framework automatically extracts that property and replaces the entire request body with it. This occurs after the schema validation is completed, meaning the system validates the outer structure, but the actual handler receives only the inner 'value' object, which may contain arbitrary, unauthorized data structures.\nThe attack flow follows a precise progression: First, an authenticated attacker identifies a route using an async validator. Second, the attacker crafts a malicious request body that satisfies the schema validation requirements while simultaneously embedding a 'value' property containing a payload designed to exploit the logic of the target handler. Third, Fastify's internal validator compiler processes the request, validates the outer object, and identifies the 'value' property.\nFourth, the vulnerability triggers: Fastify incorrectly treats the 'value' property as the intended body result, discarding the original body that was validated against the schema. Finally, the route handler executes using this substituted, unvalidated, or differently-structured object. Because the handler logic relies on the expectation that the received body strictly adheres to the schema (which it did at the point of validation), the substituted data can be used to influence downstream operations, leading to unauthorized state transitions, data disclosure, or logic flaws.\nThis behavior affects all Fastify installations using async custom validator compilers in versions prior to 5.12.2. The exposure is internal to the application's request processing pipeline, necessitating that the attacker has the ability to send requests to an affected route, typically requiring authenticated access."
}