{"schema":"threatline.record/2","record":{"id":"CVE-2026-76169","aliases":["GHSA-p68q-wchp-6fh7"],"summary":"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers","details":"### Impact\n\nFastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the `preHandler` declared in its `setNotFoundHandler()`. When the request method has no route in the main router, a malformed request target reaches Fastify's internal not-found router before URL decoding and is dispatched through a single shared handler pointer, regardless of prefix and without the normal request lifecycle. An unauthenticated request to a public prefix can therefore reach an authentication-protected not-found handler registered under a different prefix and receive its full response, breaking prefix encapsulation and bypassing the authentication hook. Applications whose private or tenant fallbacks return protected data from a not-found handler are affected.\n\n### Patches\n\nPatched in fastify 5.12.2. Malformed URLs are now routed through the configured `onBadUrl` and `onMaxParamLength` handlers so they fail closed before any application not-found handler runs, and the shared not-found handler pointer has been removed.\n\n### Workarounds\n\nReject malformed request targets before they reach the application, for example at an upstream proxy or gateway, and do not rely on a not-found handler to serve protected data. A global `onRequest` authentication hook does not mitigate this, because the malformed-URL path skips it.","categories":["Frameworks"],"product":"fastify","vendor":"fastify","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p68q-wchp-6fh7","source_modified_at":"2026-09-30T23:45:35Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fastify"},"range":">= 4.0.0, < 5.12.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76169","source_modified_at":"2026-09-04T16:20:02.318Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"fastify","vendor":"fastify","versions":[{"versionType":"semver","status":"affected","version":"4.0.0","lessThan":"5.12.2"},{"versionType":"semver","status":"unaffected","version":"5.12.2"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p68q-wchp-6fh7","source_modified_at":"2026-10-01T00:00:05.665955465Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fastify","ecosystem":"npm","purl":"pkg:npm/fastify"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"5.12.2"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-p68q-wchp-6fh7","source_modified_at":"2026-09-30T23:45:35Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fastify"},"version":"5.12.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76169","source_modified_at":"2026-09-04T16:20:02.318Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fastify","ecosystem":null},"version":"5.12.2","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-p68q-wchp-6fh7","source_modified_at":"2026-10-01T00:00:05.665955465Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"fastify","ecosystem":"npm","purl":"pkg:npm/fastify"},"version":"5.12.2"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0053,"percentile":0.44027,"score_date":"2026-10-23"},"published_at":"2026-09-04T09:51:03.556Z","modified_at":"2026-10-01T00:00:05.665955465Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-p68q-wchp-6fh7","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T23:45:35Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-76169","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-04T16:20:02.318Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-p68q-wchp-6fh7","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-01T00:00:05.665955465Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76169","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76169","source":"GitHub Advisory Database"},{"url":"https://github.com/fastify/fastify/commit/93c239a380f3f2778bb7565fcdf777e91cfe1fbc","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.2","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-p68q-wchp-6fh7","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-04T16:18:32.577097Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T00:00:05.665955465Z","content_hash":"48b525072adfff5d14c8959a0968decbbb46b18ca96f88c9e36d006899aaf1ca"}}