22 matches found
CVE-2026-117680
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking...
CVE-2026-117680
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking...
EUVD-2026-114847
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking...
CVE-2026-117680: lud jsv: Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud…
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking...
PT-2026-134904
Name of the Vulnerable Software and Affected Versions jsv versions 0.1.0 through 0.26.1 Description An improper check for unusual or exceptional conditions in the pattern and patternProperties keywords allows an unauthenticated remote attacker to bypass schema validation. The function...
GHSA-W2QP-RPH6-63G4 fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Impact fastify before 5.12.1, when a route uses a root-level primitive body schema for example an integer with a minimum and maximum and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced ...
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Impact fastify before 5.12.1, when a route uses a root-level primitive body schema for example an integer with a minimum and maximum and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced ...
NPM: fastify vulnerable to schema validation bypass via root primitive coercion mismatch
NPM: fastify vulnerable to schema validation bypass via root primitive coercion mismatch vulnerability discovered by ? in WordPress Npm fastify versions 5.12.1...
CVE-2026-18504
fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string in...
CVE-2026-18504
fastify versions before 5.12.1 suffer a schema validation bypass: when a route schema targets a root primitive (e.g., integer), Ajv coerces the input type but Fastify passes the original uncoerced value to handlers, letting invalid data reach application logic. Upgrade to 5.12.1; no workarounds e...
CVE-2026-18504
fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string in...
CVE-2026-18504 fastify vulnerable to schema validation bypass via root primitive coercion mismatch
fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string in...
CVE-2026-18504 fastify vulnerable to schema validation bypass via root primitive coercion mismatch
fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string in...
CVE-2026-18504: Improper Input Validation
fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string in...
PT-2026-77312
Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.1 Description A schema validation bypass occurs when a request body schema targets a root primitive value. When validating a top-level primitive, such as an integer, Ajv a JSON schema validator may coerce a JSON...
CVE-2026-74875
opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...
CVE-2026-74875 openssl_encrypt before 1.4.0 Schema Validation Bypass
opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...
CVE-2026-74875 openssl_encrypt before 1.4.0 Schema Validation Bypass
opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...
CVE-2026-74875
openssl_encrypt (Python package) before 1.4.0 silently skips JSON schema validation when the optional jsonschema library is absent, allowing attackers to remove that package or supply unknown metadata format versions to bypass all schema checks and process malicious data (CVSS 9.8 CRITICAL). No i...
CVE-2026-33806
A flaw was found in Fastify. A remote attacker could exploit this vulnerability by prepending a space to the Content-Type header in a request. This action bypasses the application's schema validation, allowing the attacker to submit data that would otherwise be rejected. This could lead to...