A schema validation bypass vulnerability in Fastify allows a request body that targets a root primitive type (e.g., integer) to be validated by Ajv and coerced from a string, but Fastify does not replace the original request body with the coerced value. The handler therefore receives the unvalidated string, enabling an attacker to supply data that does not meet the defined schema. This undermines the integrity of the data processed by the application and can allow access‑control checks that rely on the validated type to be bypassed, potentially leading to unauthorized actions.

The Fastify web framework for Node.js is affected. All releases prior to 5.12.1 are vulnerable. Users running these versions should consider the product legacy or upgrade path as indicated by the vendor.

The CVSS score is 5.4, indicating a moderate severity. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an HTTP request that includes a string payload matching the expected primitive type; the request bypasses validation and reaches application logic. Because no workaround exists, the risk is mitigated only by applying the vendor’s patch.