GHSA-w2qp-rph6-63g4

Suggest an improvement
Source
https://github.com/advisories/GHSA-w2qp-rph6-63g4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w2qp-rph6-63g4/GHSA-w2qp-rph6-63g4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w2qp-rph6-63g4
Aliases
Downstream
Published
2026-09-02T15:13:23Z
Modified
2026-09-02T15:31:16Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Details

Impact

fastify before 5.12.1, when a route uses a root-level primitive body schema (for example an integer with a minimum and maximum) and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced to the number 10 and passes an integer 1 to 10 schema, but request.body stays the string "10". An application that trusts the validated type is handed a value that did not satisfy the schema, which can bypass limits the application enforces on that typed value. Object and array body schemas are not affected, they coerce their members in place.

Patches

Upgrade to fastify 5.12.1.

Workarounds

Until you can upgrade, avoid relying on the validated type of a root primitive body. Wrap the value in an object schema (object properties are coerced in place), for example accept { "value": 10 } and read request.body.value, or re-check the type in the handler.

Database specific 
{
    "cwe_ids": [
        "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T15:13:23Z",
    "nvd_published_at": "2026-08-18T21:16:34Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / fastify

Package

Name
fastify
View open source insights on deps.dev
Purl
pkg:npm/fastify

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.12.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w2qp-rph6-63g4/GHSA-w2qp-rph6-63g4.json"