CyberRota Analysis
AI-GeneratedFastify versions prior to 5.12.2 are vulnerable due to improper handling of request schemas, where a boolean false is treated as a missing schema, allowing unauthenticated remote clients to bypass validation and access restricted route handlers. This flaw can lead to unauthorized state changes or execution of operations that should be disabled. Developers and organizations using affected Fastify versions should prioritize upgrading to 5.12.2 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.
Related CVEs
Other vulnerabilities affecting the same vendor(s)