fastify: fastify: Schema validation bypass via root primitive coercion mismatch (CVE-2026-18504)

Overview

A flaw was found in fastify. A remote attacker can bypass schema validation when a request body schema targets a root primitive value. This occurs because the validation process may coerce a JSON string into an expected type, but the original unvalidated string is then passed to the application logic. This can undermine integrity and access-control checks that rely on the validated type, potentially leading to unintended behavior or unauthorized access.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · updated 2026-10-16 · vex

fastify: fastify: Schema validation bypass via root primitive coercion mismatch — rated Moderate by Red Hat. Released 2026-08-18, updated 2026-10-16.

Affected:

• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)
• Red Hat OpenShift Dev Spaces

No fix planned:

• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)
• Red Hat OpenShift Dev Spaces

Remediation

Fix deferred

Workarounds / mitigations:

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Package advisory (CVE-2026-18504)

Affected packages:

• fastify < 5.12.1

Patched in:

• fastify 5.12.1

Source: https://github.com/advisories/GHSA-w2qp-rph6-63g4