AIKIDO-2026-329897
fastify is vulnerable to Request Validation Bypass
81
High Risk
This Affects:
fastifyTL;DR
Fastify's asynchronous request validation treats a resolved object shaped like { value, error } as the wrapper used by synchronous custom validators. An attacker-controlled value or error property can replace the validated request part or inject an error before the handler runs, causing the application to act on data that never satisfied the route schema. The fix prevents asynchronous validation results from replacing request data or injecting validation errors.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and a route uses an $async request schema on attacker-controlled data.
Background info
fastify is vulnerable to Request Validation Bypass in versions 0.0.1 - 5.12.1.
How to fix this
Upgrade the fastify library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.