fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that satisfied the schema. An authenticated low-privilege caller can use this to make nested data replace the validated body and trigger an operation the route schema did not authorize, leading to unauthorized state changes and data disclosure. Users should upgrade to fastify 5.12.2 or later.

A vulnerability exists in Fastify versions before 5.12.2 where the framework incorrectly treats the object resolved by a successful Ajv async validator as a custom validator compiler result protocol. If an incoming request body contains a root-level property named 'value', Fastify replaces the entire request body with that property's value before passing it to the route handler. This means the handler receives a different object than the one that was validated against the route schema. An authenticated low-privilege attacker can exploit this to bypass schema-based authorization controls, causing unauthorized state changes and potential data disclosure. The vulnerability requires authentication but can be triggered by any low-privilege user. The issue has been patched in Fastify version 5.12.2. Users are strongly advised to upgrade immediately to mitigate the risk of privilege escalation and data exposure.