Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92087— @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth

Quick assessment

Affected
@fastify/auth @fastify/auth
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个 Fastify 插件，能够将多种认证和授权策略组合为单一的路由守卫。在 5.0.0 至 5.1.0 版本中，当策略以 关系组合，同时启用 执行选项，且其中某个条目为作为 AND 分组的嵌套数组时，该分组的求值方式是顺序依赖的：较早失败的检查会被静默丢弃，分组的最终结果仅由其最后一个检查的结果决定。 因此，一个仅满足 AND 分组中最后一个成员条件的请求——例如，攻击者持有有效的 API 密钥但并非管理员——会被授权通过，而未被拒绝。此外，类似的顺序依赖绕过也影响镜像配置：当顶层关系为 且嵌套分组使用 时也会

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
@fastify/auth @fastify/auth 5.0.0< 5.1.1 affected
5.1.1 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92087

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" option and one entry is a nested array acting as an AND group, the group is evaluated in an order-dependent way: an earlier failing check is silently dropped and the group's result becomes the outcome of its last check. As a result, a request that satisfies only the last member of an AND group, for example an attacker who holds a valid API key but is not an administrator, is authorized instead of rejected, and a related order-dependent bypass affects the mirror configuration where the top-level relation is "and" and a nested group uses "or". The issue is fixed in @fastify/auth 5.1.1, and users should upgrade to 5.1.1 or later. As a workaround, omit the run "all" option where it is not required, order each AND group so its stricter check is evaluated last, or replace nested AND groups with an explicit top-level "and" composition.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/auth @fastify/auth 5.0.0 ~ 5.1.1 -

II. Public POCs for CVE-2026-92087

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92087

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92087 (1)

IV. Related Vulnerabilities

Same weakness: CWE-285

V. Comments for CVE-2026-92087

No comments yet

Leave a comment