https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-84428.htmlhttps://patchthecve.com/cve/CVE-2026-84428.htmlTue, 15 Sep 2026 19:54:32 +0000HIGH 7.5: fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the triggerhttps://patchthecve.com/cve/CVE-2026-84504.htmlhttps://patchthecve.com/cve/CVE-2026-84504.htmlTue, 15 Sep 2026 20:05:15 +0000HIGH 8.1: fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that prophttps://patchthecve.com/cve/CVE-2026-84469.htmlhttps://patchthecve.com/cve/CVE-2026-84469.htmlTue, 15 Sep 2026 20:06:50 +0000HIGH 7.5: fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to dehttps://patchthecve.com/cve/CVE-2026-76169.htmlhttps://patchthecve.com/cve/CVE-2026-76169.htmlTue, 15 Sep 2026 20:07:46 +0000HIGH 7.5: fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches ma