Fastify versions prior to 5.12.2 are vulnerable to an input validation bypass, allowing authenticated low-privilege users to perform unauthorized operations and access sensitive data.

This vulnerability involves improper input validation (CWE-20) within the Ajv async validator integration. An authenticated low-privilege attacker can manipulate the request body by including a root-level property named "value," which forces the application to process unvalidated data instead of the schema-compliant object.

The ability for a low-privilege user to bypass schema validation poses a significant risk to data integrity and confidentiality. With a CVSS score of 8.1 (High), this vulnerability allows attackers to trigger unauthorized state changes and potentially disclose sensitive information that the application was intended to protect, which could result in severe compliance and security breaches.

Immediate Action: Update the Fastify package to version 5.12.2 or later to apply the necessary fix for the validator compiler logic.

Proactive Monitoring: Monitor application logs for incoming requests containing unusual root-level JSON keys, particularly those named "value," which may indicate attempted exploitation.

Compensating Controls: Implement strict input validation at the Web Application Firewall (WAF) layer to inspect request bodies for suspicious structures or unexpected property names before they reach the backend application.

Public Exploit Available: Unknown

Given the high severity of this vulnerability, immediate action is required. Organizations utilizing Fastify must prioritize the update to version 5.12.2 to close this validation gap. Failure to patch allows authenticated users to potentially escalate their effective permissions, making rapid deployment of the vendor-supplied update a critical security imperative.