{"id":"CVE-2026-76169","revision":"14d0dcc0acb94df089443221efa0ce95","records":[{"revision":"14d0dcc0acb94df089443221efa0ce95","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-76169","aliases":[],"title":"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers","description":"fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.","state":0,"publishedAt":"2026-09-04T09:51:03.556+00:00","modifiedAt":"2026-09-04T16:20:02.318+00:00","affected":[{"ecosystem":"Vendor product","name":"fastify","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"fastify\",\n                    \"product\": \"fastify\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"5.12.2\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"5.12.2\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/fastify\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-76169","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-76169","identifiers":["CVE-2026-76169"]},"retained":false,"historicalAffected":[]}],"coverage":[]}