Struts Shared State and Fastify Keys Broke Isolation

Four Apache Struts disclosures published on 15 August exposed a common failure beneath otherwise different symptoms: state that should have belonged to one request, response or bounded input was allowed to outlive that boundary. In the same reporting window, US vulnerability records for four Fastify packages documented a related set of mistakes in cookies, verification keys and interrupted uploads.

In brief, for the window from 15 August 11:15 to 16 August 11:15 in Tehran:

• Apache disclosed two cross-request state flaws in optional Struts JSON features and two memory-exhaustion paths in its content-security-policy collector and localisation cache.
• The US National Vulnerability Database published records for four Fastify package flaws. The upstream advisories and fixes had appeared about eight hours before this window, so the in-window event was registry publication, not a second disclosure.
• A new NVD record for the AI-branded Kubio page builder described a contributor-level authorisation flaw. The “AI” label did not cause the bug; an overpowered configuration action did.
• The operational connection is isolation: a tenant, token, request or aborted upload must not change the authority or resource state inherited by the next one.

The NVD query for the exact UTC interval returned 259 records. That count is a registry workload, not 259 newly exploited incidents and not a severity ranking. The useful signal is narrower: several independently maintained application components failed at the same architectural seam.

Struts let request-scoped state become shared state

Apache bulletin S2-070, dated 15 August, says the optional Struts JSON plugin reused mutable parsing state across concurrent requests. One request could therefore influence how another request's JSON was populated, creating a cross-request data-exposure path. Apache says the feature is not enabled by default and directs users of affected Struts 7.2.1 to 7.3.0.

S2-071 describes the response-side counterpart. Serialisation state was shared across responses in the optional SMD and JSON-RPC modes, allowing response data to cross request boundaries under concurrency. Those modes are also not enabled by default, and 7.3.0 contains the fix.

The important word in both notices is not JSON but shared. A parser or serialiser can be functionally correct in a single-request test and unsafe when two requests overlap. The security invariant is that mutable request state—field filters, object graphs, exclusions, credentials and output buffers—has one owner and one lifetime. A singleton component that carries those values between calls quietly turns concurrency into an authorisation problem.

This applies directly to AI gateways and financial APIs built on the same web foundations. A model request may carry a tenant, retrieval scope, tool permissions and cost centre; a payment request may carry an account, signing context and idempotency key. If a reused object retains any of that state, accurate business logic can still execute for the wrong principal. Our earlier guide to AI cache authority boundaries reaches the same conclusion from a different subsystem: reuse is safe only when authority equivalence is explicit.

Two resource limits turned input into retained memory

The other Struts bulletins concern availability rather than cross-request disclosure. S2-073 says the optional content-security-policy violation collector read request bodies without a bound, enabling heap exhaustion through a sufficiently large submission. Apache says no collector endpoint is mapped by default. Affected releases are Struts 6.0.0 through 6.10.0 and 7.0.0 through 7.2.1; fixes are in 6.11.0 and 7.3.0.

S2-074 concerns a cache rather than a body. An attacker could vary the request locale and force the localised-text cache to grow without bound. Apache recommends 6.11.0 or 7.3.0 and identifies a fixed locale as a workaround. This issue spans a broad default surface, so teams should not dismiss it merely because the preceding three notices depend on optional features.

Both flaws convert attacker-controlled variety or volume into retained process memory. A global request-size limit, bounded cache cardinality and eviction metric are separate controls; none substitutes for the others. In a shared inference service, memory pressure can evict model caches, increase queue time or restart workers even when the model endpoint itself is not vulnerable.

Fastify showed why configuration precedence is a trust boundary

NVD published four Fastify records during the window, but their upstream GitHub advisories were posted late on 14 August, before the cutoff. Preserving that chronology matters: operators watching NVD received new registry entries; package maintainers had already published the fixes.

The highest-impact identity case is GHSA-j4cx-787j-xjqg, assigned CVE-2026-18500. In affected versions of @fastify/jwt before 10.2.2, a verification key supplied for one request could be overridden by the plugin's global secret. A route intended to accept tokens from a restricted issuer could therefore inherit a broader trust anchor. The fix in 10.2.2 changes the precedence rule.

This is not a cryptographic break. It is a configuration-resolution failure: both keys may be valid, but only one is valid for this route. Any service supporting several model providers, identity issuers or banking partners should test the resolved credential—not merely the configuration object it expected to win. The permission model in our MCP boundary analysis is analogous: the effective authority at execution time is the control that matters.

GHSA-p8h8-rj28-m8q9, CVE-2026-18165, covers @fastify/oauth2 from 7.2.0 before 8.3.0. Predictable, unprefixed OAuth cookies could be planted by a related host, creating a login-CSRF path. Version 8.3.0 adds an opt-in host-prefixed cookie mode; the advisory also describes binding the transaction to server-side session state. Cookie domain, prefix, SameSite policy and transaction binding form one control, not four interchangeable checkboxes.

Interrupted uploads must have an owner and an exit path

Two @fastify/multipart advisories concern what happens when an upload does not finish normally. GHSA-vmph-573x-85f6, CVE-2026-18549, says an oversized multipart upload could leave a handler waiting and a temporary file behind. GHSA-62qx-hpj5-j6hc, CVE-2026-19474, documents a related disconnect path in which a completed temporary file could remain after the client vanished. Both are fixed in 10.1.1.

The broader lesson is cancellation ownership. A request can end because the client disconnects, a size limit fires, a deadline expires or an upstream dependency fails. Each exit needs to cancel readers, settle promises and remove temporary resources exactly once. Otherwise an unauthenticated caller can turn cheap abandoned work into persistent disk, memory or file-descriptor pressure. The same invariant governs streamed model inputs and document-ingestion jobs, as discussed in our AI dependency inventory and incident-response guide.

Kubio was an authorisation flaw in an AI-branded surface

NVD published CVE-2026-16779 at 05:16 UTC on 16 August. The record says Kubio AI Page Builder through 2.8.5 exposed a nonce to block-editor users and then relied on it for a configuration action. A contributor could change front-page settings, navigation, template parts and global data.

Calling the product an AI page builder should not distort the diagnosis. A nonce can help establish request freshness; it does not grant the caller the right capability. The missing boundary was server-side authorisation for each configuration change. That distinction is useful for AI products because generated interfaces often sit beside conventional administration endpoints. Model safeguards cannot repair an endpoint that accepts an underprivileged role.

The operational response is an isolation review

Patch versions are the immediate action, but dependency inventory decides whether that action reaches production. Teams can turn this window into a focused review:

• Inventory runtime versions and enabled features. Record Struts JSON, SMD, JSON-RPC and CSP collector use rather than inferring exposure from a package name alone.
• Upgrade affected branches. Struts users should follow each Apache bulletin's fixed-version guidance; Fastify users should evaluate jwt 10.2.2, oauth2 8.3.0 and multipart 10.1.1 against their compatibility constraints.
• Test concurrent ownership. Interleave two principals through parsers, serializers, key resolvers and caches, then assert that no mutable state crosses requests.
• Observe the effective key. Log a non-secret key identifier, issuer and route after configuration resolution so a precedence error is visible without exposing credentials.
• Exercise every abnormal exit. Abort uploads before the first part, between parts, after a size limit and after a temporary file is complete; verify handlers settle and resources return to baseline.
• Bound attacker-controlled dimensions. Apply body limits, locale allow-lists, cache ceilings and eviction telemetry independently.
• Separate freshness from permission. Validate the authenticated principal and required capability on every administrative mutation, even when a nonce or CSRF token is valid.
• Retest under production concurrency. Single-threaded unit tests cannot demonstrate isolation for stateful components.

Limits and what to watch next

The disclosures do not establish active exploitation, and the NVD entries should not be read as incident counts. Apache's feature-specific conditions materially reduce exposure for three of its four notices. Fastify's publication sequence also means a team responding only to the in-window registry timestamp is already behind the upstream advisory clock.

The next useful evidence will be downstream version adoption, exploit-status updates from authoritative sources and any revised vendor guidance. Operators should also watch their own signals: unexpected issuer/key combinations, locale-cardinality growth, repeated aborted uploads, temporary-file accumulation and heap growth tied to input size.

The day's common thread is architectural, not vendor-specific. Isolation fails when mutable state has no single owner, when a global default outranks a narrower trust decision, or when cancellation leaves work behind. Those are ordinary application controls—but for AI and financial systems, they determine whose data, authority and compute the application actually uses.

Primary sources

• Apache Struts S2-070, 15 August 2026
• Apache Struts S2-071, 15 August 2026
• Apache Struts S2-073, 15 August 2026
• Apache Struts S2-074, 15 August 2026
• Fastify JWT advisory GHSA-j4cx-787j-xjqg, 14 August 2026
• Fastify OAuth2 advisory GHSA-p8h8-rj28-m8q9, 14 August 2026
• Fastify multipart advisory GHSA-vmph-573x-85f6, 14 August 2026
• Fastify multipart advisory GHSA-62qx-hpj5-j6hc, 14 August 2026
• NVD CVE-2026-16779 record, published 16 August 2026