fastify EUVD-2026-61221

Exploitation requires authenticated network access (CVSS PR:L confirms low-privilege authentication). The vulnerability is triggered only when a fastify route defines a body schema whose root type is a primitive (e.g., {type: 'integer'}, {type: 'number'}, {type: 'string'} with coercion relevant). Ajv's type coercion must be active, which is the default fastify configuration. The attacker must be able to submit an HTTP request with a JSON body to an endpoint governed by such a schema. Applications using exclusively object or array schemas at the root are not vulnerable to this specific bypass. Exploitation is limited to scenarios where application handlers perform security-sensitive decisions (access control, authorization checks, business rule enforcement) based on the type of request.body without independently re-validating the type inside the handler. No special operating system, cloud platform, or non-default deployment configuration is required beyond a vulnerable fastify version with at least one primitive root schema in active use.

The CVSS 3.1 score of 5.4 (Medium) captures a network-accessible flaw requiring low-privilege authentication, with limited confidentiality and integrity impact and no availability consequence. The AC:L metric reflects that exploitation is mechanically straightforward - no special race condition or environment tuning is needed. No EPSS score was included in the available intelligence, so exploitation probability cannot be quantified beyond the vector. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept code has been identified, placing this firmly in the category of a medium-priority issue rather than a crisis. That said, the practical risk is non-trivial for any application that uses root-primitive schemas to gate security decisions: even a mid-sized API operation in olsztyn running fastify-backed microservices with integer-typed authorization parameters would face a genuine integrity exposure if those type assumptions are not redundantly enforced inside handlers. The vendor's explicit statement that no workaround exists underscores that upgrading is the only reliable resolution.

An authenticated attacker targeting an API endpoint that accepts a root-level integer body (e.g., a numeric permission tier or resource identifier) submits a JSON string such as '"99"' rather than the bare integer 99. Ajv's coercion causes validation to pass, but fastify delivers the raw string '99' to the route handler. If the handler performs a strict-equality or type-sensitive comparison for authorization - for example, checking whether the submitted value equals a privileged integer constant - the type mismatch may allow the attacker to bypass the check or inject unexpected behavior into downstream business logic. No public proof-of-concept code has been identified at time of analysis.