Incorrect Behavior Order: Early Validation Affecting fastify package, versions <5.12.2

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Validation through the request validation path in lib/validation.js. An attacker can replace the validated request body, or trigger a validation failure, by sending an $async schema-validated payload that includes attacker-controlled value or error properties. When a route uses an asynchronous request schema, Fastify processes the resolved validator result before the handler runs and can pass the handler a different body than the one that satisfied the schema. This can lead to unauthorized state changes or data disclosure in applications that trust the validated request body for business logic.

Workarounds

• Avoid $async request schemas.
• Perform the security-sensitive check in an onRequest or preHandler hook rather than relying on the schema-validated request part.
• Custom async validator compilers should throw or reject on failure instead of returning an { error } object.

• GitHub Commit v5.12.2
• Maintainer's Advisory
• Red Hat Bugzilla Bug