CVE-2026-72582 fastschema CVE debrief

Who should care

Users of fastschema through v0.15.1, administrators of systems using this library, security teams monitoring for potential crashes, and operators responsible for server maintenance and incident response should be aware of this vulnerability. They should prioritize recovery endpoint validation, input sanitization, and server log monitoring to mitigate potential impacts. Vulnerability management and security teams should review and implement compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and change management processes should also be reviewed to ensure affected systems are identified and remediated promptly.

Technical summary

The fastschema library through version 0.15.1 contains a NULL pointer dereference vulnerability in the sendOTPEmail function within the pkg/auth/local.go file. An unauthenticated remote attacker can exploit this vulnerability by sending a single HTTP request to the /api/auth/local/recover endpoint, which causes the server process to crash due to a fatal panic. The vulnerability is caused by an unchecked error path that dereferences a pointer without validating it is non-nil.

Defensive priority

Server process crash possible via unauthenticated HTTP request; prioritize recovery endpoint validation.

Recommended defensive actions

• Validate and sanitize inputs to the /api/auth/local/recover endpoint.
• Implement checks for nil pointer returns from error paths in the sendOTPEmail function.
• Monitor server logs for fatal panics caused by NULL pointer dereferences.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The sendOTPEmail function in pkg/auth/local.go has a NULL pointer dereference from an unchecked error path; lacks validation for non-nil pointer, causing fatal panic on recovery request to /api/auth/local/recover. The vulnerability allows an unauthenticated remote attacker to crash the server process with a single HTTP request. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems, review server logs for fatal panics, and implement input validation and error handling.

Official resources