CVE-2026-76169: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Impact
Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler(). When the request method has no route in the main router, a malformed request target reaches Fastify's internal not-found router before URL decoding and is dispatched through a single shared handler pointer, regardless of prefix and without the normal request lifecycle. An unauthenticated request to a public prefix can therefore reach an authentication-protected not-found handler registered under a different prefix and receive its full response, breaking prefix encapsulation and bypassing the authentication hook. Applications whose private or tenant fallbacks return protected data from a not-found handler are affected.
Patches
Patched in fastify 5.12.2. Malformed URLs are now routed through the configured onBadUrl and onMaxParamLength handlers so they fail closed before any application not-found handler runs, and the shared not-found handler pointer has been removed.
Workarounds
Reject malformed request targets before they reach the application, for example at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data. A global onRequest authentication hook does not mitigate this, because the malformed-URL path skips it.
Other sources
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fastifyto a version that resolves this vulnerability.Fixed in 5.12.2 - Upgrade
Upgrade
fastifyto a version that resolves this vulnerability.Fixed in 5.12.2 - Compensating control
Reject malformed request targets before they reach the application at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Fastify versions 4.0.0 through before 5.12.2 are affected when they use encapsulated custom not-found handlers, particularly where a private fallback protected by a preHandler hook exists alongside an unrelated public plugin prefix.
What does an attacker need to exploit the bypass?
An attacker can exploit the issue remotely without authentication or user interaction by sending a malformed URL under a public sibling plugin prefix. The malformed path can be dispatched to a different plugin's private not-found handler without its authentication preHandler hook running.
What information could be exposed?
The attacker can read the full response returned by the authentication-protected private fallback handler. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.
How should this be remediated?
Upgrade Fastify to version 5.12.2 or later. The provided information does not specify an alternative mitigation for environments that cannot immediately upgrade.