What is CVE-2026-18504?
CVE-2026-18504 is a schema validation bypass vulnerability in the fastify web framework for Node.js. In versions before 5.12.1, when a request body schema targets a root primitive value (e.g., an integer), Ajv can coerce a JSON string into the expected type, bypassing validation. Users should update to the latest fastify version.
Azərbaycanca: CVE-2026-18504, Node.js üçün istifadə edilən fastify veb framework-də aşkarlanan bir schema validation bypass zəifliyidir. 5.12.1 versiyasından əvvəlki versiyalarda, request body üçün əsas primitiv dəyər (məsələn, integer) hədəfləndikdə, Ajv JSON string-i avtomatik çevirərək yoxlamadan keçə bilir. İstifadəçilər framework-i ən son versiyaya yeniləməlidir.
FAQ2
What validation mechanism can CVE-2026-18504 bypass in the fastify framework?
This vulnerability causes a schema validation bypass when a request body schema targets a root primitive value (e.g., an integer). Ajv can automatically coerce a JSON string into the expected type, allowing the validation to be circumvented.
What measure should be taken to protect against CVE-2026-18504?
Users should update the fastify framework to the latest version. The vulnerability exists in versions prior to 5.12.1.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.