{"items":[{"id":"NVI-00014063","kind":"vulnerability","title":"fastify vulnerable to schema validation bypass via root primitive coercion mismatch","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-w2qp-rph6-63g4","CVE-2026-18504"],"plain_summary":"GitHub lists this reviewed advisory for fastify. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1b1019a8afc9a4a8a7b377d8657e15bf"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-02T15:13:24.000Z","value":"5.4 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3c4472fbb4f5087f145542a3ba6b0701"},{"kind":"CVSS","as_of":"2026-09-02T14:30:22.810Z","value":"5.4 MEDIUM (3.1)","meaning":"ce714d77-add3-4f53-aff5-83d477b104bb severity; no combined Null risk score.","source_id":"sr-1b1019a8afc9a4a8a7b377d8657e15bf"},{"kind":"CVSS","as_of":"2026-09-02T14:30:22.810Z","value":"5.3 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-1b1019a8afc9a4a8a7b377d8657e15bf"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3c4472fbb4f5087f145542a3ba6b0701","url":"https://github.com/advisories/GHSA-w2qp-rph6-63g4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w2qp-rph6-63g4","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:43.711Z"},{"id":"sr-1b1019a8afc9a4a8a7b377d8657e15bf","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18504","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-18504","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-07T13:57:03.791Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3c4472fbb4f5087f145542a3ba6b0701"],"technology":"fastify","known_exclusions":[],"conditions_summary":"### Impact\n\n`fastify` before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body `\"10\"` is coerced to the number `10` and passes an integer 1 to 10 schema, but `request.body` stays the string `\"10\"`. An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.\n\n### Patches\n\nUpgrade to `fastify` 5.12.1.\n\n### Workarounds\n\nUntil you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept `{ \"value\": 10 }` and read `request.body.value`, or re-check the type in the handler.","public_affected_ranges":["< 5.12.1"]}],"null_published_at":"2026-11-07T18:43:12.070Z","source_updated_at":"2026-09-02T15:13:24.000Z","source_disclosed_at":"2026-09-02T15:13:23.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-02T02:21:43.711Z"},{"id":"NVI-00014063","kind":"vulnerability","title":"fastify vulnerable to schema validation bypass via root primitive coercion mismatch","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-w2qp-rph6-63g4","CVE-2026-18504"],"plain_summary":"GitHub lists this reviewed advisory for fastify. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3c4472fbb4f5087f145542a3ba6b0701"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-02T15:13:24.000Z","value":"5.4 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3c4472fbb4f5087f145542a3ba6b0701"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3c4472fbb4f5087f145542a3ba6b0701","url":"https://github.com/advisories/GHSA-w2qp-rph6-63g4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w2qp-rph6-63g4","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:43.711Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3c4472fbb4f5087f145542a3ba6b0701"],"technology":"fastify","known_exclusions":[],"conditions_summary":"### Impact\n\n`fastify` before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body `\"10\"` is coerced to the number `10` and passes an integer 1 to 10 schema, but `request.body` stays the string `\"10\"`. An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.\n\n### Patches\n\nUpgrade to `fastify` 5.12.1.\n\n### Workarounds\n\nUntil you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept `{ \"value\": 10 }` and read `request.body.value`, or re-check the type in the handler.","public_affected_ranges":["< 5.12.1"]}],"null_published_at":"2026-11-02T10:00:37.202Z","source_updated_at":"2026-09-02T15:13:24.000Z","source_disclosed_at":"2026-09-02T15:13:23.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:21:43.711Z"}],"next_cursor":null,"snapshot_revision":"42594"}