Four Gaps in Fastify

• CVE-2026-76169: an invalid request target could reach a sibling plugin’s fallback for unmatched routes without running its preHandler or the global onRequest hook. The affected range is 4.0.0 to before 5.12.2.
• CVE-2026-84469: the boolean false, used as a request schema, could be treated as absent, allowing the handler to run.
• CVE-2026-84428: header dependencies could be skipped through incomplete case normalisation. A shared header schema reached through an external $ref remains outside the fix when added with addSchema; FSTSEC002 warns, and the vendor advises an inline schema.
• CVE-2026-84504: when request validation is asynchronous, a root-level value property could make the handler receive the nested value instead of the checked request data. The latter three advisories list versions before 5.12.2.

Make the patch decision reviewable

BlackTree analysis: Collect the deployed version and route map; prioritise private or privileged handlers. Move affected services to the patched release. A 4.x deployment needs a supported migration or fix decision. In controlled tests, prove rejection for each pattern present. For $async, include a benign root-level value and confirm the handler receives the unchanged body. Review FSTSEC002. Save the test result and build identity; an ordinary success does not test the boundary.

Sources

• Release and advisories A, B, C, D, all dated 4 September 2026.