CVE-2026-18504 Overview
CVE-2026-18504 is a schema validation bypass in Fastify, a low-overhead web framework for Node.js. Versions of Fastify before 5.12.1 fail to replace the root request body with the value coerced by Ajv when a request body schema targets a top-level primitive. Route handlers therefore receive the original unvalidated string instead of the validated and coerced value. Requests that should fail validation can reach application logic, undermining integrity and access-control checks that depend on the validated type. The issue is tracked as an input validation flaw [CWE-20] and requires an authenticated network request to trigger.
Critical Impact
Route handlers receive unvalidated primitive values, allowing attackers to bypass type-based integrity and access-control checks in Fastify applications before version 5.12.1.
Affected Products
- Fastify versions prior to 5.12.1
- Node.js applications using Fastify with request body schemas targeting root primitives
- Fastify routes relying on Ajv type coercion for request body validation
Discovery Timeline
- 2026-08-18 - CVE-2026-18504 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-18504
Vulnerability Analysis
Fastify delegates request body validation to Ajv, which supports type coercion between JSON strings and primitive types such as integers or booleans. When a route schema validates a top-level primitive value, Ajv coerces the incoming JSON string into the declared type during validation. Fastify does not propagate the coerced value back onto the request body. The route handler consequently reads request.body as the original untyped string.
The result is a validation and handler mismatch. Validation reports success against the coerced value, while application code receives a value that does not satisfy the schema. Downstream logic that assumes a validated numeric or boolean type can be manipulated by supplying values a JavaScript coerces or compares differently at runtime. Access-control decisions, arithmetic operations, and equality checks are all candidates for abuse.
Root Cause
The root cause is a state synchronization gap between the Ajv validator and the Fastify request pipeline for schemas whose top-level type is a primitive. Object and array bodies are re-bound after coercion, but root primitives are not. This falls under improper input validation [CWE-20] because the validated value never becomes the value used by the handler.
Attack Vector
An attacker submits a request whose body is a JSON string that would fail strict schema validation but succeeds under Ajv coercion. For a schema declaring { "type": "integer" }, an attacker sends a quoted numeric string or a non-numeric string depending on how the handler consumes the value. The handler then compares or forwards the raw string, bypassing any integrity check that assumed the schema had enforced the primitive type. Exploitation requires low privileges and no user interaction, and the request travels over the network.
No verified public exploit code is available. Refer to the GitHub Fastify Security Advisory for maintainer-supplied technical detail.
Detection Methods for CVE-2026-18504
Indicators of Compromise
- Requests to Fastify routes where request.body is logged as a string despite a schema declaring a primitive type such as integer, number, or boolean.
- Application errors or unexpected branches triggered by string-versus-number comparisons in route handlers that expect a validated primitive.
- 2xx responses to requests whose payloads contain quoted primitives that should not satisfy a strict schema.
Detection Strategies
- Inventory all Fastify routes and identify schemas where the top-level type is a primitive rather than object or array.
- Add runtime assertions in affected handlers that re-check typeof request.body against the declared schema type and alert on mismatches.
- Review dependency manifests (package.json, package-lock.json, yarn.lock) for Fastify versions below 5.12.1.
Monitoring Recommendations
- Enable structured request logging that captures Content-Type, schema route ID, and the JavaScript type of request.body for post-hoc analysis.
- Alert on repeated validation-success events followed by handler exceptions related to type coercion or NaN arithmetic.
- Track application error rates on endpoints that consume primitive bodies after upgrading dependencies.
How to Mitigate CVE-2026-18504
Immediate Actions Required
- Upgrade Fastify to version 5.12.1 or later across all Node.js services.
- Audit route schemas for top-level primitive types and refactor them to wrap the value in an object schema where practical.
- Add explicit type checks in handlers that accept root primitive bodies until the upgrade is verified in production.
Patch Information
The maintainers fixed the mismatch in Fastify 5.12.1. The release ensures the coerced root primitive value replaces request.body before the handler executes. See the GitHub Fastify Security Advisory and the OpenJS Foundation Security Advisories for release notes and advisory metadata.
Workarounds
- No workarounds are available according to the maintainer advisory; upgrading to Fastify 5.12.1 is required.
- As a defense-in-depth measure until upgrade, wrap affected endpoints so bodies are re-parsed and type-checked before use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
