CVE-2026-92087

@fastify/auth versions 5.0.0 through 5.1.0 mishandle nested strategy groups: when strategies are composed with the 'or' relation together with the run 'all' option and one entry is a nested array acting as an AND group, evaluation is order-dependent, so an earlier failing check is silently dropped and the group's result becomes the outcome of its last check. As a result, a request that satisfies only the final member of an AND group — for example, a caller holding a valid API key but lacking administrator rights — is authorized instead of rejected, granting access or privileges the AND group was intended to deny; a mirrored order-dependent bypass affects configurations where the top-level relation is 'and' with a nested 'or' group. Any application using @fastify/auth 5.0.0–5.1.0 with these specific compositions is affected, and exploitation requires only a low-privileged identity that satisfies the last check in the group (no user interaction). No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.

What to do: Upgrade to @fastify/auth 5.1.1 or later. If upgrading is not immediately possible, audit route definitions for the 'or' relation combined with run 'all' (and the mirrored top-level 'and' with nested 'or' groups), omit run 'all' where it is not required, order each AND group so its stricter check is evaluated last, or replace nested AND groups with an explicit top-level 'and' composition. Also review authorization logs for access granted to identities holding only weaker credentials (e.g., API keys) where administrator-level checks were expected.