CVE-2026-18504

[CVE catalog]

Severity

Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Published

Aug 18, 2026, 8:19:12 PM UTC

Updated

Aug 18, 2026, 9:16:34 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.28% · Oct 25, 2026

A flaw was found in fastify. A remote attacker can bypass schema validation when a request body schema targets a root primitive value. This occurs because the validation process may coerce a JSON string into an expected type, but the original unvalidated string is then passed to the application logic. This can undermine integrity and access-control checks that rely on the validated type, potentially leading to unintended behavior or unauthorized access. fastify: fastify: Schema validation bypass via root primitive coercion mismatch A moderate severity schema validation bypass was found in fastify, a Node.js web framework bundled in Red Hat OpenShift AI (RHOAI) container images. When a route's request body schema targets a root primitive value (such as a top-level integer), the Ajv-based validation process may coerce a JSON string into the expected type during validation, but fastify does not replace the root request body with the coerced value. As a result, the route handler receives the original unvalidated string, and a remote attacker can cause a request that should have failed validation to reach application logic with a value that does not satisfy the schema. This can undermine integrity and access-control checks that rely on the validated type, potentially leading to unintended behavior or unauthorized access. The affected RHOAI components bundle the fastify 4.x release line, while the upstream fix is only available in a later major release line of fastify, so updating the bundled dependency is deferred to a future product release. Until then, a residual risk remains for applications that rely on root primitive request body schemas to enforce type-based integrity or access-control checks. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.