---
id: CVE-2026-18504
title: >-
  fastify: fastify: Schema validation bypass via root primitive coercion
  mismatch (CVE-2026-18504)
summary: >-
  A flaw was found in fastify. A remote attacker can bypass schema validation
  when a request body schema targets a root primitive value. This occurs because
  the validation process may coerce a JSON string into an expected type, but the
  origi…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-843
  - CWE-20
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
  - openshift_dev_spaces
patched:
  - fastify 5.12.1
published: '2026-08-18'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T11:22:49+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18504.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18504.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-18504'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2518254'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-18504'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18504'
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/fastify/fastify/security/advisories/GHSA-w2qp-rph6-63g4'
  - url: >-
      https://github.com/fastify/fastify/commit/1ef8a60c87e94f42f666aa15ad68957772a83655
  - url: 'https://github.com/fastify/fastify/releases/tag/v5.12.1'
  - url: 'https://github.com/advisories/GHSA-w2qp-rph6-63g4'
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - ghsa
  - npm
epss: 0.0028
epssPercentile: 0.20374
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/HORKimhab/CVE-2026-18504-CVE-2026-16732'
  checkedAt: '2026-10-27T17:00:57.798Z'
exploitAvailable: true
aliases:
  - GHSA-w2qp-rph6-63g4
ecosystem: npm
ingestedAt: '2026-09-02T15:46:29.577Z'
---

## Overview

A flaw was found in fastify. A remote attacker can bypass schema validation when a request body schema targets a root primitive value. This occurs because the validation process may coerce a JSON string into an expected type, but the original unvalidated string is then passed to the application logic. This can undermine integrity and access-control checks that rely on the validated type, potentially leading to unintended behavior or unauthorized access.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18504.json)

**fastify: fastify: Schema validation bypass via root primitive coercion mismatch** — rated Moderate by Red Hat. Released 2026-08-18, updated 2026-10-16.

Affected:

- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces

No fix planned:

- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces

## Remediation

Fix deferred

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

## Package advisory (CVE-2026-18504)

Affected packages:

- `fastify < 5.12.1`

Patched in:

- `fastify 5.12.1`

Source: https://github.com/advisories/GHSA-w2qp-rph6-63g4