{"id":"CVE-2026-76169","aliases":["CLSA-2026-1790854816","CLSA-2026-1790857029","CLSA-2026-1790863084","CLSA-2026-1790871227","CLSA-2026-1790889495","CLSA-2026-1792233089","CLSA-2026-1794060794","EUVD-2026-70988","GHSA-p68q-wchp-6fh7"],"status":"published","title":"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers","description":"fastify versions \u003e= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0053,"percentile":0.45171,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288"],"published":"2026-09-04T09:51:03Z","modified":"2026-11-07T19:00:36Z","fixes":[{"ecosystem":"npm","package":"fastify","fixed_in":["5.12.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fastify","fixed_in":["5.11.3-tuxcare.4","5.7.4-tuxcare.3","5.2.1-tuxcare.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.12.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.1-tuxcare.0"},{"fixed":"5.12.1-tuxcare.1"}]}],"versions":["5.12.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.12.0-tuxcare.0"},{"fixed":"5.12.0-tuxcare.2"}]}],"versions":["5.12.0","5.12.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.3-tuxcare.0"},{"fixed":"5.11.3-tuxcare.4"}]}],"versions":["5.11.3","5.11.3-tuxcare.1","5.11.3-tuxcare.2","5.11.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.4-tuxcare.0"},{"fixed":"5.7.4-tuxcare.3"}]}],"versions":["5.7.4","5.7.4-tuxcare.1","5.7.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-tuxcare.0"},{"fixed":"5.2.1-tuxcare.3"}]}],"versions":["5.2.1","5.2.1-tuxcare.1","5.2.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.29.1-tuxcare.0"},{"fixed":"4.29.1-tuxcare.7"}]}],"versions":["4.29.1","4.29.1-tuxcare.1","4.29.1-tuxcare.2","4.29.1-tuxcare.3","4.29.1-tuxcare.4","4.29.1-tuxcare.5","4.29.1-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.1-tuxcare.0"},{"fixed":"4.28.1-tuxcare.1"}]}],"versions":["4.28.1"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"fastify","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"5.12.2"}]}]}],"products":[{"vendor":"@clerk","product":"fastify"},{"vendor":"fastify","product":"fastify"}],"references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7","tags":["Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76169","tags":["advisory"]},{"url":"https://github.com/fastify/fastify/commit/93c239a380f3f2778bb7565fcdf777e91cfe1fbc","tags":["web"]},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p68q-wchp-6fh7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76169.json","tags":["advisory"]},{"url":"https://github.com/fastify/fastify","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-76169","title":"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers","description":"fastify versions \u003e= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T09:51:03.556Z","modified":"2026-09-04T16:20:02.318Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T13:46:10.323375Z"}],"euvd":[{"id":"EUVD-2026-70988","description":"fastify versions \u003e= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T09:51:03Z","modified":"2026-09-04T16:20:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:12.302717Z"}],"ghsa":[{"id":"GHSA-p68q-wchp-6fh7","title":"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers","description":"### Impact\n\nFastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the `preHandler` declared in its `setNotFoundHandler()`. When the request method has no route in the main router, a malformed request target reaches Fastify's internal not-found router before URL decoding and is dispatched through a single shared handler pointer, regardless of prefix and without the normal request lifecycle. An unauthenticated request to a public prefix can therefore reach an authentication-protected not-found handler registered under a different prefix and receive its full response, breaking prefix encapsulation and bypassing the authentication hook. Applications whose private or tenant fallbacks return protected data from a not-found handler are affected.\n\n### Patches\n\nPatched in fastify 5.12.2. Malformed URLs are now routed through the configured `onBadUrl` and `onMaxParamLength` handlers so they fail closed before any application not-found handler runs, and the shared not-found handler pointer has been removed.\n\n### Workarounds\n\nReject malformed request targets before they reach the application, for example at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data. A global `onRequest` authentication hook does not mitigate this, because the malformed-URL path skips it.","status":"published","published":"2026-09-30T23:45:34Z","modified":"2026-09-30T23:45:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-76169","description":"fastify versions \u003e= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T10:17:12.02Z","modified":"2026-09-15T20:07:46.7Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:12:43.737972Z"}],"osv":[{"id":"CVE-2026-76169","title":"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers","description":"fastify versions \u003e= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.","status":"published","published":"2026-09-04T09:51:03.556Z","modified":"2026-10-28T02:30:58.762162052Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"GHSA-p68q-wchp-6fh7","title":"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers","description":"### Impact\n\nFastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the `preHandler` declared in its `setNotFoundHandler()`. When the request method has no route in the main router, a malformed request target reaches Fastify's internal not-found router before URL decoding and is dispatched through a single shared handler pointer, regardless of prefix and without the normal request lifecycle. An unauthenticated request to a public prefix can therefore reach an authentication-protected not-found handler registered under a different prefix and receive its full response, breaking prefix encapsulation and bypassing the authentication hook. Applications whose private or tenant fallbacks return protected data from a not-found handler are affected.\n\n### Patches\n\nPatched in fastify 5.12.2. Malformed URLs are now routed through the configured `onBadUrl` and `onMaxParamLength` handlers so they fail closed before any application not-found handler runs, and the shared not-found handler pointer has been removed.\n\n### Workarounds\n\nReject malformed request targets before they reach the application, for example at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data. A global `onRequest` authentication hook does not mitigate this, because the malformed-URL path skips it.","status":"published","published":"2026-09-30T23:45:34Z","modified":"2026-10-01T00:00:05.665955465Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"CLSA-2026-1790854816","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.1-tuxcare.1.","status":"published","published":"2026-10-01T11:40:16Z","modified":"2026-10-15T09:47:59.984131956Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790857029","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.12.0-tuxcare.2.","status":"published","published":"2026-10-01T12:17:09Z","modified":"2026-10-15T09:47:59.910201248Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790863084","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.11.3-tuxcare.4.","status":"published","published":"2026-10-01T13:58:04Z","modified":"2026-10-15T09:47:41.970359269Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790871227","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 5.7.4-tuxcare.3.","status":"published","published":"2026-10-01T16:13:47Z","modified":"2026-10-15T09:48:04.305439526Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790889495","title":"TuxCare security update for fastify (1 CVE)","description":"TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.2.1-tuxcare.3.","status":"published","published":"2026-10-01T21:18:15Z","modified":"2026-10-15T09:47:57.771452889Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792233089","title":"TuxCare security update for fastify (2 CVEs)","description":"TuxCare rebuilt fastify to address 2 CVEs. Fixed in 4.29.1-tuxcare.7.","status":"published","published":"2026-10-17T10:31:29Z","modified":"2026-10-17T13:09:28.819028485Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1794060794","title":"TuxCare security update for fastify (6 CVEs)","description":"TuxCare rebuilt fastify to address 6 CVEs. Fixed in 4.28.1-tuxcare.1.","status":"published","published":"2026-11-07T15:13:14Z","modified":"2026-11-07T19:00:36.656813145Z","updated_at":"2026-11-07T19:21:34.633914Z"}]}}