CVE-2026-76169: Fastify Authentication Bypass via Malformed URLs
Summary
CVE-2026-76169: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers. Affects fastify versions >= 4.0.0, < 5.12.2. Fixed in 5.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastify is a web framework for Node.js that is designed to be fast and low overhead. It provides a robust set of features for building web applications and APIs, including routing, middleware support, and plugin architecture. However, it has been identified that certain malformed URLs can lead to an authentication bypass, compromising the security of applications that rely on Fastify for handling requests.
Vulnerability Detail
The vulnerability arises when Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin. This behavior allows the last registered handler to be invoked while skipping the preHandler declared in its setNotFoundHandler. As a result, an unauthenticated request to a public prefix can access an authentication-protected not-found handler registered under a different prefix, thereby breaching prefix encapsulation and bypassing authentication mechanisms. This issue can lead to unauthorized access to sensitive data returned by private or tenant fallback handlers.
How To Fix
Latest published version: 5.12.7 as of 22 Oct 2026
npm install fastify@5.12.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.12.2
This is the first release that contains the fix.
npm install fastify@5.12.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, reject malformed request targets before they reach the application. This can be done at an upstream proxy or gateway. Additionally, avoid relying on a not-found handler to serve protected data. Implementing a global onRequest authentication hook will not mitigate this issue, as malformed URLs bypass it.
Conclusion
In summary, CVE-2026-76169 is a significant vulnerability in Fastify that can lead to authentication bypass through malformed URLs. It is crucial for developers using Fastify to update to version 5.12.2 or later to mitigate this risk. Implementing additional workarounds can further enhance security until the update is applied.
See every vulnerability recorded for fastify →
FAQ
CVE-2026-76169 is a vulnerability in Fastify that allows authentication bypass through malformed URLs, potentially exposing sensitive data.
If your application uses Fastify and has authentication-protected not-found handlers, this vulnerability could allow unauthorized users to access sensitive information.
The vulnerability affects Fastify versions prior to 5.12.2. It is recommended to upgrade to this version or later.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastify.
