CVE-2026-76169: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fastifyto a version that resolves this vulnerability.Fixed in 5.12.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Fastify versions 4.0.0 through before 5.12.2 are affected when they use encapsulated custom not-found handlers, particularly where a private fallback protected by a preHandler hook exists alongside an unrelated public plugin prefix.
What does an attacker need to exploit the bypass?
An attacker can exploit the issue remotely without authentication or user interaction by sending a malformed URL under a public sibling plugin prefix. The malformed path can be dispatched to a different plugin's private not-found handler without its authentication preHandler hook running.
What information could be exposed?
The attacker can read the full response returned by the authentication-protected private fallback handler. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.
How should this be remediated?
Upgrade Fastify to version 5.12.2 or later. The provided information does not specify an alternative mitigation for environments that cannot immediately upgrade.