Improper Validation of Specified Type of Input Affecting fastify package, versions <5.12.2

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the route schema handling in lib/route.js, lib/schemas.js, and lib/validation.js. An attacker can reach a route handler with arbitrary input by sending a request to an endpoint that uses false as a deny-all schema for body, querystring, params, headers, or the query alias. Because those schemas were treated as absent when evaluated for JavaScript truthiness, Fastify skipped validator compilation and let the request proceed to the handler, allowing unauthenticated access to routes that were intended to reject every request.

Workarounds

• Express a deny-all request schema with an always-failing object schema such as { "not": {} } instead of the boolean false, so the route still rejects requests before they reach the handler.
• Reject the request in an onRequest hook, so unauthenticated clients are blocked before route handling even if a request-part schema was defined with false.

• GitHub Commit v5.12.2
• Maintainer's Advisory
• Red Hat Bugzilla Bug