CVE-2026-18504

fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string into the expected type during validation, but Fastify does not replace the root request body with the coerced value, so the route handler receives the original unvalidated string. As a result, a request that should have failed validation can reach application logic with a value that does not satisfy the schema, which can undermine integrity and access-control checks that rely on the validated type. Users should upgrade to fastify 5.12.1, which fixes the mismatch. No known workarounds are available.

• CWE-20

• https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
• https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4Mitigation, Vendor Advisory

Published

Aug 18, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18499IBM WebSphere Application Server - Liberty 17.0.0.3 through …8.1
• CVE-2026-1850Complex queries can cause excessive memory usage in MongoDB …7.5
• CVE-2026-18500@fastify/jwt is a JSON Web Token plugin for Fastify. In vers…8.1
• CVE-2026-18501The UsersWP – Front-end login form, User Registration, User …6.4
• CVE-2026-18502Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-18503Attacker-controlled CSV samples can trigger super-linear re…2.4
• CVE-2026-18505IBM Financial Transaction Manager (FTM) for RedHat OpenShift…5.4
• CVE-2026-18508A flaw was found in GNU tar. When extracting an archive with…4.4
• CVE-2026-18509IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticat…7.1
• CVE-2026-1851The iVysilani Shortcode plugin for WordPress is vulnerable t…6.4
• CVE-2026-18510The TranslatePress – Translate Multilingual sites with AI Tr…7.2
• CVE-2026-18511IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticat…7.8