Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-76169— fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Quick assessment

Affected
fastify fastify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fastify 版本 >= 4.0.0 且 < 5.12.2 存在一个路由缺陷：当恶意构造的 URL 发送到一个插件前缀下时，请求会被错误地路由到另一个兄弟插件的自定义 not-found 处理器，并且该处理器在未被其声明的 preHandler 钩子拦截的情况下被调用。 具体来说，封装式（encapsulated）处理器的内部 not-found 路由器在 URL 解码之前，通过一个共享的处理器指针来分派格式错误的路径，从而忽略了前缀并跳过了所选处理器的正常生命周期。 因此，一个未认证的攻击者可以通过一个不相关的

CVSS 7.5 · High EPSS 0.53% · P43

Affected Version Matrix 2

VendorProduct Version RangeStatus
fastify fastify 4.0.0< 5.12.2 affected
5.12.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76169

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Source: CVE Program / CVE List V5
Vulnerability Description
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fastify fastify 4.0.0 ~ 5.12.2 -

II. Public POCs for CVE-2026-76169

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76169

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-76169 (1)

Same Patch Batch · fastify · 2026-09-04 · 4 CVEs total

CVE-2026-84504 8.1 HIGH fastify vulnerable to request body replacement via an async validation result collision
CVE-2026-84428 7.5 HIGH fastify vulnerable to header validation bypass via incomplete schema case normalization
CVE-2026-84469 7.5 HIGH fastify vulnerable to request validation bypass via skipped boolean false schemas

IV. Related Vulnerabilities

Same product: fastify
Same vendor: fastify
Same weakness: CWE-288

V. Comments for CVE-2026-76169

No comments yet

Leave a comment