CVE-2026-18504

Analyzed Analyzed - Analysis Complete

Schema Validation Bypass in Fastify

Publication date: 2026-08-18

Last updated on: 2026-09-02

Assigner: openjs

Description

fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string into the expected type during validation, but Fastify does not replace the root request body with the coerced value, so the route handler receives the original unvalidated string. As a result, a request that should have failed validation can reach application logic with a value that does not satisfy the schema, which can undermine integrity and access-control checks that rely on the validated type. Users should upgrade to fastify 5.12.1, which fixes the mismatch. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-02

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-18504

EUVD

EUVD-2026-61221

Affected Vendors & Products

Vendor	Product	Version / Range
fastify	fastify	to 5.12.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Fastify web framework for Node.js before version 5.12.1. It allows a schema validation bypass when a request body schema targets a root primitive value like an integer. Ajv may coerce a JSON string into the expected type during validation, but Fastify does not update the request body with this coerced value. This means the route handler receives the original unvalidated string, potentially allowing invalid requests to reach application logic.

Detection Guidance

This vulnerability can be detected by checking the version of Fastify in use. Run 'npm list fastify' or check your package.json to see if the version is below 5.12.1. If it is, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to bypass input validation and send requests that should have been rejected. This may lead to integrity issues, unauthorized access, or incorrect data processing if your application relies on validated types for access control or business logic.

Compliance Impact

This vulnerability could undermine compliance with standards like GDPR and HIPAA by allowing invalid or coerced data to bypass schema validation. This may lead to improper access control or data integrity issues if the application relies on validated types for security checks.

Mitigation Strategies

Upgrade Fastify to version 5.12.1 or later using 'npm update fastify' or by updating the package.json file and reinstalling dependencies. No known workarounds exist.

Hi! I’m here to help you understand CVE-2026-18504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70