CVE-2026-18504: fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Impact
fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.
Patches
Upgrade to fastify 5.12.1.
Workarounds
Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.
Other sources
fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string into the expected type during validation, but Fastify does not replace the root request body with the coerced value, so the route handler receives the original unvalidated string. As a result, a request that should have failed validation can reach application logic with a value that does not satisfy the schema, which can undermine integrity and access-control checks that rely on the validated type. Users should upgrade to fastify 5.12.1, which fixes the mismatch. No known workarounds are available.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fastifyto a version that resolves this vulnerability.Fixed in 5.12.1 - Upgrade
Upgrade
fastifyto a version that resolves this vulnerability.Fixed in 5.12.1 - Configuration
Until upgraded, avoid relying on the validated type of a root primitive request body schema; instead wrap the value in an object schema (e.g., accept {"value":10} and use request.body.value) or re-check the value’s type in the route handler.
Fastify route body schema design Root primitive body schema usage with type coercion = Avoid (use object wrapper or re-check type in handler)
Event History
Frequently Asked Questions
Which routes are most relevant to triage?
Applications using Fastify versions before 5.12.1 are exposed when a route validates its request body as a top-level primitive, such as an integer. Routes whose security or integrity decisions rely on the body having the validated primitive type are the relevant attack surface.
What does an attacker need to exploit this issue?
An attacker needs network access to a vulnerable route and the ability to send a JSON string where the route expects a root primitive value. The request can pass validation after Ajv coercion, while the handler receives the original string instead of the coerced primitive.
What remediation is available?
Upgrade Fastify to version 5.12.1. The advisory states that no known workarounds are available if upgrading cannot be done immediately.
How can we identify potentially affected application code?
Review routes that use request-body schemas with a top-level primitive type and determine whether handlers assume the received value has that validated type. Affected versions are Fastify releases before 5.12.1.