fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Impact
Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler(). When the request method has no route in the main router, a malformed request target reaches Fastify's internal not-found router before URL decoding and is dispatched through a single shared handler pointer, regardless of prefix and without the normal request lifecycle. An unauthenticated request to a public prefix can therefore reach an authentication-protected not-found handler registered under a different prefix and receive its full response, breaking prefix encapsulation and bypassing the authentication hook. Applications whose private or tenant fallbacks return protected data from a not-found handler are affected.
Patches
Patched in fastify 5.12.2. Malformed URLs are now routed through the configured onBadUrl and onMaxParamLength handlers so they fail closed before any application not-found handler runs, and the shared not-found handler pointer has been removed.
Workarounds
Reject malformed request targets before they reach the application, for example at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data. A global onRequest authentication hook does not mitigate this, because the malformed-URL path skips it.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | fastify | >= 4.0.0, < 5.12.2 | 5.12.2 |
References
- https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7
- https://nvd.nist.gov/vuln/detail/CVE-2026-76169
- https://github.com/fastify/fastify/commit/93c239a380f3f2778bb7565fcdf777e91cfe1fbc
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify
- https://github.com/fastify/fastify/releases/tag/v5.12.2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-288- Platform
- npm
- Package
fastify- Disclosed
- 30.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-p68q-wchp-6fh7 - CC BY 4.0
Vulnerability history: fastify
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 16
- First → latest
- 07.2018 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 8
- Medium 7
- Low 1
Disclosures per year
- 2018: 1
- 2019: 0
- 2020: 1
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 1
- 2026: 11
-
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.