---
id: CVE-2026-18504
aliases:
  - GHSA-w2qp-rph6-63g4
title: >-
  fastify vulnerable to schema validation bypass via root primitive coercion
  mismatch
summary: >-
  fastify vulnerable to schema validation bypass via root primitive coercion
  mismatch
severity: medium
cvss: 5.4
cwe:
  - CWE-20
vendor: fastify
product: fastify
ecosystem: npm
affected:
  - fastify < 5.12.1
patched:
  - fastify 5.12.1
published: '2026-09-02'
updated: '2026-09-02'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-w2qp-rph6-63g4'
references:
  - url: 'https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18504'
  - url: >-
      https://github.com/fastify/fastify/commit/1ef8a60c87e94f42f666aa15ad68957772a83655
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/fastify/fastify/releases/tag/v5.12.1'
  - url: 'https://github.com/advisories/GHSA-w2qp-rph6-63g4'
tags:
  - ghsa
  - npm
  - exploit-available
epss: 0.00309
epssPercentile: 0.21114
ingestedAt: '2026-09-02T15:46:29.577Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/HORKimhab/CVE-2026-18504-CVE-2026-16732'
  checkedAt: '2026-09-25T08:20:52.022Z'
exploitAvailable: true
---

## Overview

### Impact

`fastify` before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body `"10"` is coerced to the number `10` and passes an integer 1 to 10 schema, but `request.body` stays the string `"10"`. An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.

### Patches

Upgrade to `fastify` 5.12.1.

### Workarounds

Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept `{ "value": 10 }` and read `request.body.value`, or re-check the type in the handler.

## Affected packages

- `fastify < 5.12.1`

## Remediation

Upgrade to a patched release:

- `fastify 5.12.1`