Description
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
Published: 2026-09-04
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Fastify versions 4.x through 5.12.1 incorrectly route malformed URLs through a shared not‑found handler before URL decoding, ignoring the plugin prefix and bypassing the preHandler hook. This flaw lets an external user reach a private fallback route that is normally protected by authentication and read its full response, effectively circumventing the intended access controls.

Affected Systems

All Fastify releases from 4.0.0 up to, but not including, 5.12.2 are affected. The vulnerability resides in the core routing logic that handles encapsulated plugin routes.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, and while EPSS data is unavailable, the flaw can be exploited by any unauthenticated client that can send a crafted request over the network. The vulnerability is not currently listed in the CISA KEV catalog, but the potential for sensitive data exposure makes it a strong candidate for immediate patching.

Generated by OpenCVE AI on September 4, 2026 at 11:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Fastify to version 5.12.2 or later to apply the vendor‑provided fix.
  • If the upgrade is delayed, remove or disable custom not‑found handlers in sibling plugins or enforce authentication on those handlers so that they cannot be reached via malformed URLs.
  • Add input validation or URL sanitization to the application layer to prevent malformed paths from reaching the encapsulated routing logic.

Generated by OpenCVE AI on September 4, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-289
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 04 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Fastify
Fastify fastify
Vendors & Products Fastify
Fastify fastify

Fri, 04 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Description fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
Title fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Weaknesses CWE-288
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Fastify Fastify
cve-icon MITRE

Status: PUBLISHED

Assigner: openjs

Published:

Updated: 2026-09-04T09:51:03.556Z

Reserved: 2026-08-19T09:33:54.670Z

Link: CVE-2026-76169

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T10:17:12.020

Modified: 2026-09-04T10:17:12.020

Link: CVE-2026-76169

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-04T09:51:03Z

Links: CVE-2026-76169 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T11:30:17Z

Weaknesses
  • CWE-288

    Authentication Bypass Using an Alternate Path or Channel

  • CWE-289

    Authentication Bypass by Alternate Name