fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string into the expected type during validation, but Fastify does not replace the root request body with the coerced value, so the route handler receives the original unvalidated string. As a result, a request that should have failed validation can reach application logic with a value that does not satisfy the schema, which can undermine integrity and access-control checks that rely on the validated type. Users should upgrade to fastify 5.12.1, which fixes the mismatch. No known workarounds are available.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fastify | fastify | before 5.12.1 | 5.12.1 | Patch available | CNA |
| — | fastify (npm) | before 5.12.1 | 5.12.1 | Patch available | GHSA-w2qp-rph6-63g4 |
- fastify Vendorfastify Affected before 5.12.1 Fixed in 5.12.1 Patch available CNA
- fastify (npm) Vendor— Affected before 5.12.1 Fixed in 5.12.1 Patch available GHSA-w2qp-rph6-63g4
Remediation
- Fix · CNA fastify (fastify) Fixed in 5.12.1
- Fix · GHSA-w2qp-rph6-63g4 fastify (npm) Fixed in 5.12.1 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
fastify 5.12.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-13934 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-countPriority LOW 26
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18504
- 2026-10-03 Alias added: GHSA-w2qp-rph6-63g4
References
Advisory 3
More Fastify vulnerabilities
- TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
- TI-2025-23513 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass CVSS 3.1HIGH 7.5
- TI-2026-58050 fastify vulnerable to request validation bypass via skipped boolean false schemas CVSS 3.1HIGH 7.5
- TI-2026-58022 fastify vulnerable to header validation bypass via incomplete schema case normalization CVSS 3.1HIGH 7.5
- TI-2026-53284 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVSS 3.1HIGH 7.5
- TI-2026-26178 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header CVSS 3.1HIGH 7.5
Sources
- CVE-2026-18504 · CVE Program
- CVE-2026-18504 · NVD
- FIRST EPSS
- GHSA-w2qp-rph6-63g4 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-18504 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences