CVE-2026-18504 fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Attackers can bypass schema validation in fastify by sending primitive values that coerce during validation but remain unvalidated in handlers, undermining integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18504?
CVE-2026-18504 is a medium-severity vulnerability in fastify, published on 18 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string into the expected type during validation, but Fastify does not replace the root request body with the coerced value, so the route handler receives the original unvalidated string. As a result, a request that should have failed validation can reach application logic with a value that does not satisfy the schema, which can undermine integrity and access-control checks that rely on the validated type. Users should upgrade to fastify 5.12.1, which fixes the mismatch. No known workarounds are available.
Weakness: CWE-20
Which versions are affected by CVE-2026-18504?
2 open source packages ship an affected version, including fastify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fastify npm | All versions | 5.12.1 |
fastify npm | All versions | 5.12.1 |
Products include Fastify Fastify.
How do I fix CVE-2026-18504?
Upgrade fastify to 5.12.1 or later.
Is CVE-2026-18504 being exploited?
There is no known exploitation of CVE-2026-18504 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in fastify
- CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision
- CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas
- CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
Sources
Also known as CLSA-2026-1788431312, CLSA-2026-1789896356, CLSA-2026-1789917910, GHSA-w2qp-rph6-63g4, MINI-fjp3-cgc9-wgrr.