CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
An unauthenticated attacker can bypass authentication hooks to read protected responses from encapsulated not-found handlers via malformed URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76169?
CVE-2026-76169 is a high-severity authentication bypass vulnerability in fastify, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
Weakness: CWE-288
Which versions are affected by CVE-2026-76169?
2 open source packages ship an affected version, including fastify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fastify npm | From 4.0.0 | 5.12.2 |
fastify npm | From 4.0.0 | 5.12.2 |
Products include Fastify Fastify.
How do I fix CVE-2026-76169?
Upgrade fastify to 5.12.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-76169 being exploited?
There is no known exploitation of CVE-2026-76169 in the wild and no public exploit code.
Other vulnerabilities in fastify
- CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision
- CVE-2026-84428 fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas
- CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header
- CVE-2026-25223 Fastify's Content-Type header tab character allows body validation bypass
Sources
Also known as CLSA-2026-1790863084, CLSA-2026-1790871227, CLSA-2026-1790889495, GHSA-p68q-wchp-6fh7, MINI-v23q-6ffp-9r2f.