Schema Validation Bypass in Fastify Web Framework by Fastify
CVE-2026-18504
Key Information:
Badges
What is CVE-2026-18504?
A schema validation bypass in the Fastify web framework can allow unvalidated request bodies to reach the application logic. Affected versions prior to 5.12.1 fail to replace the root request body with a coerced value when a request body schema targets a top-level primitive. This allows invalid data types, such as a JSON string instead of an expected integer, to be processed by the application. Consequently, this can compromise data integrity and access controls that rely on accurate type validation, which could lead to potential security risks. Users are strongly advised to upgrade to Fastify version 5.12.1, which addresses this issue.
Affected Version(s)
fastify 0 < 5.12.1
fastify 5.12.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved