CVE-2026-76169

Fastify versions 4.0.0 up to but not including 5.12.2 contain a routing flaw in which the internal not-found router for encapsulated plugin handlers dispatches malformed URLs through a single shared handler pointer before URL decoding, ignoring the prefix. An unauthenticated attacker can send a malformed URL under one plugin's public prefix, causing the custom not-found handler of a different sibling plugin to be invoked without the preHandler hook declared for that handler. This lets the attacker reach an authentication-protected private fallback handler through an unrelated public prefix and read its full response, bypassing authentication with confidentiality impact only (no integrity or availability effect). Applications built on Fastify 4.0.0 through 5.12.1 that use encapsulated plugin prefixes with custom not-found handlers and preHandler-based authentication are affected. No public proof-of-concept or in-the-wild exploitation is known; the issue is not in CISA KEV and EPSS estimates only about a 0.5% probability of exploitation within 30 days.

What to do: Upgrade to fastify 5.12.2 or later. As an interim measure, avoid relying solely on preHandler hooks for authentication on custom not-found handlers and consider normalizing or rejecting malformed URLs at the edge (e.g., reverse proxy). Audit applications that register multiple sibling plugin prefixes with encapsulated not-found handlers for authentication-protected fallbacks reachable via malformed URLs.