CVE-2026-92087: @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth
@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" option and one entry is a nested array acting as an AND group, the group is evaluated in an order-dependent way: an earlier failing check is silently dropped and the group's result becomes the outcome of its last check. As a result, a request that satisfies only the last member of an AND group, for example an attacker who holds a valid API key but is not an administrator, is authorized instead of rejected, and a related order-dependent bypass affects the mirror configuration where the top-level relation is "and" and a nested group uses "or". The issue is fixed in @fastify/auth 5.1.1, and users should upgrade to 5.1.1 or later. As a workaround, omit the run "all" option where it is not required, order each AND group so its stricter check is evaluated last, or replace nested AND groups with an explicit top-level "and" composition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@fastify/authto a version that resolves this vulnerability.Fixed in 5.1.1 - Configuration
As a workaround (if you cannot upgrade yet), omit the run "all" option where it is not required.
@fastify/auth run option ('all') = omit the run "all" option where it is not required - Configuration
Reorder each AND group so its stricter check is evaluated last.
@fastify/auth strategy evaluation order within AND groups = order each AND group so its stricter check is evaluated last - Configuration
If you use nested AND groups, replace them with an explicit top-level "and" composition.
@fastify/auth nested AND group composition = replace nested AND groups with an explicit top-level "and" composition
Event History
Frequently Asked Questions
Which authentication configurations are affected?
Affected configurations combine relation "or" with run "all" and include a nested array used as an AND group. A related bypass also affects the mirror arrangement: a top-level "and" relation with a nested OR group.
What would an attacker need to bypass an affected route guard?
The attacker needs to satisfy only the last check in a vulnerable nested group rather than every required check. For example, a user with a valid API key but without administrator authorization could be accepted if the API-key check is last in the affected AND group.
What can be done before upgrading?
Omit run "all" where it is not required, place the stricter check last in each AND group, or replace nested AND groups with an explicit top-level "and" composition. Upgrade to version 5.1.1 or later when possible.