GHSA-w2qp-rph6-63g4: Input Validation
Impact
fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.
Patches
Upgrade to fastify 5.12.1.
Workarounds
Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fastifyto a version that resolves this vulnerability.Fixed in 5.12.1 - Upgrade
Upgrade
fastifyto a version that resolves this vulnerability.Fixed in 5.12.1 - Configuration
Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), e.g., accept `{ "value": 10 }` and use `request.body.value`, or re-check the type again inside the handler. (Issue affects Fastify before 5.12.1 for routes using root-level primitive body schemas with default type coercion.)
Fastify route schema Root-level primitive body schema handling (validated type vs handler value) = Wrap root primitive in an object schema and read the coerced property (e.g., request.body.value)
Event History
Frequently Asked Questions
Which applications are affected?
Applications using fastify before 5.12.1 are affected only when a route body schema is a root-level primitive, such as an integer schema. Routes using object or array body schemas are not affected because their members are coerced in place.
What does an attacker need to exploit this?
An attacker needs access to send a request to a route with an affected root-level primitive body schema. They can submit a value such as the JSON string "10", which passes validation after coercion while the handler receives the original string.
How can this be mitigated before upgrading?
Do not rely on the validated type of a root primitive request body. Wrap the value in an object schema and read the coerced property, such as request.body.value, or explicitly re-check the type in the route handler.
How can I determine whether a route is vulnerable?
Review routes for body schemas that define a primitive at the schema root and rely on default type coercion. Test with a coercible input such as a JSON string for an integer schema; if validation passes but request.body remains a string, the route is affected.