AIKIDO-2026-530080
fastify is vulnerable to Request Validation Bypass
75
High Risk
This Affects:
fastifyTL;DR
Fastify's request-schema compilation uses a truthiness check that skips the valid JSON Schema value false for body, querystring, query, params, and headers. A route that uses false as a deny-all schema receives no validator, allowing an unauthenticated client to reach the handler with arbitrary input. The fix uses an explicit presence check so boolean schemas are always compiled and enforced.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and a route uses a boolean false request schema.
Background info
fastify is vulnerable to Request Validation Bypass in versions 0.0.1 - 5.12.1.
How to fix this
Upgrade the fastify library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.