CVE-2026-76169 in Fastify
Summary
by MITRE • 09/04/2026
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Fastify versions greater than or equal to 4.0.0 and prior to 5.12.2 represents a critical flaw in the framework's routing logic, specifically concerning how malformed URLs are processed within encapsulated plugin hierarchies. This issue stems from an incorrect handling of path resolution when a request contains a malformed URL under one plugin prefix is directed toward the custom not-found handler of a sibling plugin. In normal operation, Fastify utilizes internal routers to manage route matching and ensure that each plugin maintains its own isolated context for handlers and hooks. However, in this specific scenario involving malformed paths, the internal not-found router dispatches these requests through a single shared handler pointer before performing URL decoding. This architectural oversight causes the framework to ignore the original prefix associated with the request and bypasses the selected handler's normal lifecycle execution flow.
From a technical perspective, the core defect lies in the sequence of operations during error handling for malformed inputs. Instead of validating the path structure against the specific plugin context before invoking fallback handlers, Fastify routes these requests through a generic not-found mechanism that does not respect encapsulation boundaries. Consequently, when such a request is made, it triggers the custom not-found handler belonging to a different sibling plugin rather than remaining within the intended scope or returning an appropriate error for the original prefix. This behavior effectively breaks the isolation guarantees provided by Fastify's encapsulated handlers, allowing cross-plugin interference that should be impossible under normal routing conditions.
The operational impact of this vulnerability is severe, particularly in applications relying on authentication and authorization hooks to protect sensitive endpoints. An unauthenticated attacker can exploit this flaw by sending a carefully crafted malformed URL through an unrelated public prefix to reach what would normally be an authentication-protected private fallback handler. Because the request bypasses the preHandler hook declared for that specific not-found handler, any authentication checks or access control logic attached to it are skipped entirely. This allows the attacker to read the full response from protected resources without valid credentials, effectively circumventing security controls and exposing sensitive data or internal application states that were intended to remain inaccessible.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves unauthorized access to restricted functionality due to flawed authorization logic in routing mechanisms. It also relates to CWE-798 Use of Hard-coded Credentials if the not-found handler returns sensitive information by default, and potentially CWE-611 Information Exposure Through an Error Message if the response reveals internal details. In terms of MITRE ATT&CK mapping, this behavior facilitates Initial Access or Discovery phases where attackers probe for misconfigurations to bypass authentication mechanisms, specifically leveraging Improper Privilege Management techniques to access resources outside their intended permissions.
To mitigate this risk and restore proper encapsulation and security boundaries, users must upgrade Fastify to version 5.12.2 or later. This release includes the necessary corrections in the routing engine to ensure that malformed URLs are handled within the correct plugin context without bypassing declared hooks. Until upgrading is possible, developers should implement additional input validation at a reverse proxy level or middleware layer outside of Fastify to sanitize and validate URL structures before they reach the application framework. Additionally, reviewing not-found handlers for sensitive data exposure and ensuring that critical security checks are implemented in multiple layers can provide defense-in-depth against such routing bypasses.