CVE-2026-92087 in auth
Summary
by MITRE • 09/16/2026
@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" option and one entry is a nested array acting as an AND group, the group is evaluated in an order-dependent way: an earlier failing check is silently dropped and the group's result becomes the outcome of its last check. As a result, a request that satisfies only the last member of an AND group, for example an attacker who holds a valid API key but is not an administrator, is authorized instead of rejected, and a related order-dependent bypass affects the mirror configuration where the top-level relation is "and" and a nested group uses "or". The issue is fixed in @fastify/auth 5.1.1, and users should upgrade to 5.1.1 or later. As a workaround, omit the run "all" option where it is not required, order each AND group so its stricter check is evaluated last, or replace nested AND groups with an explicit top-level "and" composition.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The @fastify/auth plugin serves as a critical component in many Node.js applications built on the Fastify framework, responsible for composing multiple authentication and authorization strategies into unified route guards. In versions 5.0.0 through 5.1.0 of this library, a significant logical flaw exists within the evaluation engine when handling complex compositions of security policies. Specifically, the vulnerability manifests when strategies are composed using an OR relation at the top level while simultaneously utilizing the run all option to ensure every strategy is executed. Within these configurations, if one entry in the composition is a nested array representing an AND group, the plugin fails to enforce strict logical conjunctions correctly due to order-dependent evaluation logic. This defect allows attackers to bypass security controls by exploiting the sequence in which checks are performed within the grouped strategies.
The technical root cause of this vulnerability lies in how the library processes failing checks within an AND group when the run all option is active. In a correct implementation, an AND group should require that every member condition be satisfied for the entire group to return true; if any single check fails, the result must immediately reflect failure regardless of subsequent outcomes. However, due to this flaw, an earlier failing check within such a nested array is silently dropped from the final evaluation logic. Consequently, the outcome of the AND group becomes determined solely by its last evaluated member rather than the aggregate state of all members. This behavior fundamentally breaks the logical integrity required for authorization decisions, effectively reducing strict conjunctions into weaker disjunction-like evaluations depending on input order.
The operational impact of this vulnerability is severe, as it leads to unauthorized access scenarios where users who do not meet all specified security criteria are granted privileges they should be denied. For instance, consider a scenario where an AND group requires both a valid API key and administrator role status. If the check for administrator status appears before the check for the API key in the nested array, and the user lacks administrative rights but possesses a valid key, the system may incorrectly authorize the request because it only evaluates the final successful condition. This order-dependent bypass affects not only configurations with an OR relation at the top level but also mirrors situations where the top-level relation is AND and a nested group uses OR logic. Such inconsistencies create unpredictable security postures that depend entirely on developer implementation choices rather than enforced policy rules, undermining trust in the authentication mechanism.
This vulnerability aligns closely with CWE-20 Improper Input Validation as it involves incorrect processing of logical conditions based on input structure and order. It also relates to CWE-862 Missing Authorization since the flaw results in granting access without verifying all required permissions. From an ATT&CK perspective, this represents a technique for privilege escalation or unauthorized access via logic flaws rather than traditional exploitation vectors like buffer overflows or injection attacks. The persistence of such bugs highlights the risks associated with complex authorization libraries that abstract away low-level security checks into high-order functions, potentially obscuring critical validation steps from developers who assume default behaviors are secure by design.
To mitigate this vulnerability, organizations using affected versions must upgrade @fastify/auth to version 5.1.1 or later, where the logical evaluation engine has been corrected to properly enforce conjunctions and disjunctions regardless of order. For environments unable to immediately patch, several workarounds can reduce risk. Developers should omit the run all option unless strictly necessary for logging or side-effect purposes, as this mode triggers the flawed logic path. Additionally, when constructing nested AND groups, developers must manually ensure that stricter checks are positioned last in the array so they determine the final outcome if earlier checks fail silently. Another robust mitigation involves replacing nested AND groups with explicit top-level and compositions to avoid ambiguous evaluation contexts entirely. Regular auditing of authorization code paths is recommended to identify similar logical dependencies before deployment.