{"id":"CVE-2026-18504","title":"fastify: fastify: Schema validation bypass via root primitive coercion mismatch (CVE-2026-18504)","summary":"A flaw was found in fastify. A remote attacker can bypass schema validation when a request body schema targets a root primitive value. This occurs because the validation process may coerce a JSON string into an expected type, but the origi…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvssSource":"vendor","cwe":["CWE-843","CWE-20"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_dev_spaces"],"patched":["fastify 5.12.1"],"published":"2026-08-18","updated":"2026-10-16","sourceUpdated":"2026-10-16T11:22:49+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18504.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18504.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-18504"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2518254"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18504"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18504"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4"},{"url":"https://github.com/fastify/fastify/commit/1ef8a60c87e94f42f666aa15ad68957772a83655"},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.1"},{"url":"https://github.com/advisories/GHSA-w2qp-rph6-63g4"}],"tags":["csaf","vex","red-hat","exploit-available","ghsa","npm"],"epss":0.0028,"epssPercentile":0.20374,"exploits":{"github":1,"githubRepos":["https://github.com/HORKimhab/CVE-2026-18504-CVE-2026-16732"],"checkedAt":"2026-10-27T17:00:57.798Z"},"exploitAvailable":true,"aliases":["GHSA-w2qp-rph6-63g4"],"ecosystem":"npm","ingestedAt":"2026-09-02T15:46:29.577Z","slug":"CVE-2026-18504","body":"## Overview\n\nA flaw was found in fastify. A remote attacker can bypass schema validation when a request body schema targets a root primitive value. This occurs because the validation process may coerce a JSON string into an expected type, but the original unvalidated string is then passed to the application logic. This can undermine integrity and access-control checks that rely on the validated type, potentially leading to unintended behavior or unauthorized access.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18504.json)\n\n**fastify: fastify: Schema validation bypass via root primitive coercion mismatch** — rated Moderate by Red Hat. Released 2026-08-18, updated 2026-10-16.\n\nAffected:\n\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Dev Spaces\n\nNo fix planned:\n\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Dev Spaces\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-18504)\n\nAffected packages:\n\n- `fastify < 5.12.1`\n\nPatched in:\n\n- `fastify 5.12.1`\n\nSource: https://github.com/advisories/GHSA-w2qp-rph6-63g4","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4977,"id":"CVE-2026-18504","ts":1788887223471,"field":"exploit_available","old":"false","new":"true"},{"seq":3860,"id":"CVE-2026-18504","ts":1788886355433,"field":"exploit_available","old":"true","new":"false"},{"seq":2688,"id":"CVE-2026-18504","ts":1788883020719,"field":"exploit_available","old":"false","new":"true"},{"seq":1717,"id":"CVE-2026-18504","ts":1788882425189,"field":"exploit_available","old":"true","new":"false"},{"seq":823,"id":"CVE-2026-18504","ts":1788881858606,"field":"exploit_available","old":"false","new":"true"}]}