CVE-2026-18504

Executive Summary

CVE-2026-18504 is a schema validation bypass vulnerability affecting Fastify, a widely adopted high-performance web framework for Node.js, in all versions prior to 5.12.1. The flaw arises when a request body schema targets a root primitive value (e.g., integer, boolean): during validation, Ajv (the JSON schema validator used by Fastify) coerces a JSON string into the expected type, but Fastify fails to replace the request body with the coerced value. Consequently, the route handler receives the original unvalidated string, allowing requests that should be rejected by schema validation to reach application logic. This undermines integrity and access-control checks that rely on schema-validated types. The vulnerability is exploitable by authenticated low-privilege users (CVSS 5.4, Medium severity) and can lead to partial loss of confidentiality and integrity.

Technical Analysis

Vulnerability Mechanism

The root cause of CVE-2026-18504 lies in a mismatch between Fastify's validation layer and Ajv's type-coercion behavior. Fastify uses Ajv to validate incoming request bodies against JSON schemas defined per-route. When a schema declares a top-level primitive type — such as type: "integer" — Ajv optionally performs type coercion: a request body containing a JSON string like "42" is accepted and internally coerced to the number 42 during the validation pass.

However, Fastify does not synchronize its internal request body state with the coerced value produced by Ajv. After validation completes, the route handler receives the original, unmodified request body — the raw string "42" — rather than the coerced integer. From the application's perspective, the validation accepted the payload (because Ajv reported success), but the underlying value remains a string that violates the schema.

This behavior creates a validation bypass: an attacker can submit a payload that should fail strict schema validation but is instead passed directly to application logic. The integrity risk is amplified in applications that use schema type as an implicit trust boundary — for example, routes that check typeof value === 'number' for authorization decisions or pass the value to database queries expecting an integer type.

Attack Surface

The attack surface includes all Fastify applications running versions prior to 5.12.1 that:

• Use JSON schema validation for request bodies (schema: { body: {...} }).
• Define a root-level primitive type in the body schema (e.g., { type: 'integer' }, { type: 'boolean' }, { type: 'number' }).
• Rely on schema validation for security-critical logic (access control, input sanitization, type enforcement).

The vulnerability class is CWE-20 (Improper Input Validation). The attack is network-based, requires low privileges (an authenticated session), and involves no user interaction.

Technical Details

Specific payload structures and function names beyond those in the NVD description are not available in the public advisory. The mechanism can be summarized at the class level as:

• Ajv validates the payload and applies coercion logic.
• Fastify's internal body representation is not updated post-coercion.
• The route handler receives the original, unvalidated data type.

No public PoC exists as of this report. Insufficient technical detail is available to describe exact code-level implementation beyond the NVD description.

Exploitation Scenarios

Based strictly on the NVD description and vulnerability class, the following attack chain is plausible:

Step 1 — Reconnaissance / Target Identification

An authenticated attacker with low privileges scans a Fastify application for endpoints that expose a JSON body schema with a root-level primitive type. This may be identified through:

• API documentation (OpenAPI/Swagger) that reveals schema definitions.
• Error messages that leak schema expectations (e.g., overly verbose validation responses).
• Existing knowledge of the application's routing behavior.

Step 2 — Triggering the Flaw

The attacker identifies a route where the body schema declares a primitive type (e.g., "integer") and submits a request with a JSON string payload instead, such as "123" instead of 123. Ajv's coercion logic validates the string as acceptable; Fastify accepts the request as valid.

Step 3 — Payload Execution

Because no public PoC exists, the attack chain is inferred from the vulnerability class:

• Attacker: POST /api/resource with body "123" (a JSON string).
• Fastify validation: schema { type: 'integer' } — Ajv coerces and validates successfully.
• Route handler: receives "123" as a string, not the coerced integer 123.
• Application logic: if the application uses type-based checks (e.g., if (typeof id === 'number')) for authorization or query construction, the string bypasses that control and propagates to downstream systems.

Step 4 — Post-Exploitation Impact

• Integrity compromise (CVSS I:L): The attacker can supply values that circumvent input-sanitization layers, potentially injecting malicious strings into database queries, file paths, or command arguments.
• Confidentiality compromise (CVSS C:L): In routes where access control relies on validated primitive types (e.g., a numeric user ID), the attacker may access or infer information outside the intended scope.
• No privilege escalation inherent: The attacker remains at their prior privilege level; the impact is limited to data manipulation and potential information disclosure.

No public exploit code or in-the-wild evidence has been reported. The attack chain is inferred from the vulnerability class and NVD description.

Impact Assessment

Business Impact

• Confidentiality Impact (Low): Exploitation can lead to limited unauthorized information disclosure where type-based checks gate data access.
• Integrity Impact (Low): Attackers can submit unvalidated data types that violate schema constraints, potentially corrupting business logic, bypassing audit controls, or poisoning downstream data stores.
• Availability Impact (None): The vulnerability does not directly cause system or service downtime.

Affected Systems

• All Fastify deployments running versions before 5.12.1.
• Applications using request body schemas with root-level primitive types.
• Backend services exposed to authenticated users (the PR:L requirement).

Blast Radius

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates an uncomplicated network attack requiring low privileges. While the scope is unchanged (S:U), the medium severity (5.4) reflects that the flaw is not remotely exploitable without authentication, but it can compound with other weaknesses. In production microservice architectures, compromised input validation can cascade into downstream consumers if type expectations propagate across service boundaries.

No associated threat-actor campaigns have been identified for this CVE.

Detection Guidance

The following detection content is designed to identify exploitation attempts of CVE-2026-18504. Since no public PoC exists, these rules focus on anomalous behavior consistent with the vulnerability mechanism: requests that send primitive-coercible types where strict schemas are expected.

Sigma Rule

title: Fastify Schema Validation Bypass - Primitive Type Mismatch
id: 7f3c4a2e-9d4b-4f8c-b1a5-3c6d8e9f0a1b
status: experimental
description: Detects HTTP requests indicating potential Fastify schema validation bypass where root primitive types (integer, number, boolean) are submitted as strings.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18504
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: fastify
    service: http
detection:
    selection_body_json:
        http.body|contains: '"'   # JSON string delimiters
    selection_content_type:
        http.content_type|contains: 'application/json'
    selection_method:
        http.method|contains: 'POST'
    filter_valid_integer_routes:
        http.url|contains:
            - '/validate'
            - '/auth'
            - '/api/'
    condition: selection_body_json and selection_content_type and selection_method and not filter_valid_integer_routes
falsepositives:
    - Legitimate API calls that accept string values for endpoints documented as string-type.
level: medium

YARA Rule

rule Fastify_Schema_Bypass_CVE_2026_18504
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects string payloads that may bypass root primitive schema validation in Fastify"
        cve = "CVE-2026-18504"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = /"Content-Type"\s*:\s*"application\/json"/
        $b = /"body"\s*:\s*"\d+"/         // string-encoded integer
        $c = /"body"\s*:\s*"(true|false)"/ // string-encoded boolean
        $d = /"body"\s*:\s*"\d+\.\d+"/    // string-encoded float

    condition:
        any of ($a*) and any of ($b*) and filesize < 100KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18504 Fastify Schema Validation Bypass - Primitive String Body"; flow:established,to_server; content:"POST"; http_method; content:"application/json"; http_header_names; content:"\""; http_client_body; pcre:"/\"[0-9]+\"\s*$/U"; classtype:attempted-admin; sid:202618504; rev:1;)

Note: This rule matches POST requests with JSON content type and a client body ending in a quoted numeric string, which alone is not malicious — tune for known schema routes in production.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.type == "connection" and process.name == "node" ]
  [ process where process.name == "node" and args contains "fastify" ]
  [ file where event.action == "read" and file.extension == "js" and file.name like "*route*" ]

Note: Since CVE-2026-18504 is an application-layer logic flaw, host-level EQL detection is limited. The above rule surfaces the presence of Fastify-based Node.js processes for threat hunting.

Splunk SPL Query

index=web sourcetype=access_combined earliest=-7d
| where like(_raw, "%POST%") AND like(_raw, "%application/json%")
| regex _raw="\"(true|false|[0-9]+(\.[0-9]+)?)\""
| table _time, src_ip, uri, http_method, status, http_user_agent
| stats count by src_ip, uri
| where count > 5

This query flags source IPs that repeatedly POST JSON bodies containing quoted primitives, which may indicate automated attempts to probe validation bypass.

Wazuh OSSEC Rule

<group name="fastify,">
  <rule id="100185" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">\.+</field>
    <field name="http_method">POST</field>
    <description>Fastify CVE-2026-18504: Schema validation bypass attempt - string primitive in JSON body</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>fastify_validation_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

1) Immediate Mitigations (until patch is applied):

• Upgrade: The only official resolution is upgrading to fastify 5.12.1 or later. No workarounds are documented by the vendor.
• Input Sanitization Layer: Add an explicit post-validation check in route handlers that re-asserts the expected type with a strict JavaScript type check (e.g., typeof value === 'number') before using the value in security-sensitive operations.
• Disable Ajv Coercion: If Fastify configuration allows, disable Ajv's coerceTypes option (set to false) to prevent type coercion during validation. This forces strict type matching. Refer to Fastify documentation for the exact configuration key — do not invent parameter names.
• WAF Rule: Deploy a Web Application Firewall rule at the edge to flag JSON request bodies where the top-level value is a quoted primitive (stringified number/boolean) destined for known primitive-schema routes.

2) Patch/Upgrade Steps:

• Upgrade to fastify 5.12.1: npm install fastify@5.12.1 or update the version pin in package.json and re-run npm ci/yarn install.
• Re-test all routes that use root-level primitive schemas after migration.
• Review application release notes for any breaking changes in the 5.12.1 update.

3) Long-Term Hardening:

• Enforce schema validation as a security control, not just a data-format convenience. Treat validation failures as rejections, not coercions.
• Adopt an API-first design where schemas are the single source of truth and validated independently of framework behavior (e.g., run a validation test corpus in CI).
• Implement defense-in-depth: application logic should never rely solely on schema validation for type safety; use language-level type enforcement (TypeScript, Joi/zod) within route handlers.
• Monitor Fastify security advisories and subscribe to the project's GitHub release feed for timely patch deployment.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18504
2. Fastify Official Site: https://fastify.dev/ — vendor framework documentation and release history.
3. Fastify GitHub Releases: https://github.com/fastify/fastify/releases — source of patched version 5.12.1.
4. CWE-20 Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html — vulnerability taxonomy reference.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — confirmed NOT listed for this CVE (as of this report).

Threat Actor Campaigns: No known threat actor groups or exploit-in-the-wild activity has been reported for CVE-2026-18504 as of this writing. The PoC/exploit status is UNKNOWN. Enterprises running Fastify should prioritize patching given the simplicity of the attack once a target is identified.