Input validation error in Fastify - CVE-2026-18504
Published: August 19, 2026
Vulnerability identifier: #VU144298
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18504
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass application-enforced limits and disclose sensitive information.
The vulnerability exists due to improper input validation in root-level primitive body schema handling when processing crafted JSON request bodies with default type coercion enabled. A remote user can send a specially crafted request to bypass application-enforced limits and disclose sensitive information.
Only routes that use a root-level primitive body schema with default type coercion are affected. Object and array body schemas are not affected, and user interaction is not required.
Affected software
Fastify
How to mitigate CVE-2026-18504
Install security update from vendor's website.
Fastify - update to 5.12.1