CVE-2026-76169 · GHSA-p68q-wchp-6fh7

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Risk score: 64/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.5%
Published: 30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler(). When the request method has no route in the main router, a malformed request target reaches Fastif…
Affected: fastify (npm) >= 4.0.0, < 5.12.2
Fix: Upgrade fastify to 5.12.2 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

fastify: Amber, patch this week. Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler(). When the request method has no route in the main router, a malformed request target reaches Fastif…

The flaws

CVE-2026-76169: Fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers (CVSS 7.5 · EPSS 1%)
CVE-2026-84428: Fastify vulnerable to header validation bypass via incomplete schema case normalization (CVSS 7.5 · EPSS 1%)
CVE-2026-84469: Fastify vulnerable to request validation bypass via skipped boolean false schemas (CVSS 7.5 · EPSS 0%)
CVE-2026-84504: Fastify vulnerable to request body replacement via an async validation result collision (CVSS 8.1 · EPSS 0%)

The fix

Fix: Upgrade fastify to 5.12.2 or later.

Who is exposed: fastify (npm) >= 4.0.0, < 5.12.2

Where it stands

No known exploitation

Connects to

Same weakness: Authentication bypass (CWE-288). 33 other warnings in 30 days

Why it is Amber

CVSS 7.5 high
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
fastify	npm	>= 4.0.0, < 5.12.2	5.12.2

References

Original description

### Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the `preHandler` declared in its `setNotFoundHandler()`. When the request method has no route in the main router, a malformed request target reaches Fastify's internal not-found router before URL decoding and is dispatched through a single shared handler pointer, regardless of prefix and without the normal request lifecycle. An unauthenticated request to a public prefix can therefore reach an authentication-protected not-found handler registered under a different prefix and receive its full response, breaking prefix encapsulation and bypassing the authentication hook. Applications whose private or tenant fallbacks return protected data from a not-found handler are affected. ### Patches Patched in fastify 5.12.2. Malformed URLs are now routed through the configured `onBadUrl` and `onMaxParamLength` handlers so they fail closed before any application not-found handler runs, and the shared not-found handler pointer has been removed. ### Workarounds Reject malformed request targets before they reach the application, for example at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data. A global `onRequest` authentication hook does not mitigate this, because the malformed-URL path skips it.

Last activity 30 Sep 2026. Patch Forecast updates every hour.