fastify versions prior to 5.12.2 incorrectly treat the boolean value false as an absent schema when compiling request schemas, even though JSON Schema Draft 7 defines false as a valid schema that rejects all instances. When an application assigns false to a route’s body, querystring, params, or headers schema, fastify compiles no validator and executes the route handler for any request. This denial‑by‑false schema bypass gives an unauthenticated remote client the ability to invoke functions that were intended to be unreachable, potentially leading to unauthorized state changes or execution of operations that have been explicitly disabled. The weakness is a classic example of insecure input handling (CWE‑20).

The affected product is the fastify framework. All releases of fastify before version 5.12.2 are vulnerable. The bypass can occur on any route that assigns the boolean value false to its body, querystring, params, or headers validation schema.

The vulnerability carries a CVSS score of 7.5, indicating high severity. The EPSS score is 0.00519 (less than 1%), indicating a very low but non‑zero probability of exploitation, but the attack vector is clear: an unauthenticated remote client can send arbitrary HTTP requests to any route using a false schema. Because the fix is purely a server‑side code change, the risk is mitigated immediately by updating the framework. The vulnerability is not listed in CISA’s KEV catalog, but the high CVSS score and potential for unauthorized execution warrant prompt action.