Fastify versions before 5.12.2 incorrectly treat the object returned by a successful asynchronous Ajv validator as the result of a custom validator compiler. If the validated request body contains a root property named "value", Fastify replaces the entire body with that property's value before executing the route handler. The handler then operates on a different object than the one that satisfied the schema, allowing an authenticated low‑privilege caller to inject nested data that the route schema did not anticipate. This can lead to unauthorized modifications to application state and the disclosure of sensitive information.

All releases of the Fastify HTTP framework for Node.js that precede version 5.12.2, particularly applications that use Fastify with asynchronous Ajv validation. The regression exists across every route that relies on custom validators and is removed by upgrading to Fastify 5.12.2 or later.

The CVSS score of 8.1 indicates high severity, and the vulnerability is not listed in CISA KEV. EPSS data is not available. An attacker who has low‑privilege authentication can craft a request that satisfies the route schema yet contains a top‑level "value" property; the resulting body replacement occurs before the route handler runs, enabling the attacker to trigger unintended operations. No additional privilege escalation is required beyond normal authentication, but the impact on confidentiality, integrity, or availability can be significant if the affected route performs privileged actions.