CVE-2026-76169

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76169
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76169.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-76169
Aliases
  • GHSA-p68q-wchp-6fh7
Published
2026-09-04T09:51:03Z
Modified
2026-09-10T03:30:58Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Details

fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.

Database specific 
{
    "cna_assigner": "openjs",
    "cwe_ids": [
        "CWE-288"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76169.json"
}
References

Affected packages

Git / github.com/fastify/fastify

Affected ranges

Type
GIT
Repo
https://github.com/fastify/fastify
Events
Introduced
e941c24bf51af7184cf658ca138e069e8c166ef8
Fixed
942a2be8704244db778f8db9a0bb4951b8825156
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "5.12.2"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.2.0
v4.2.1
v4.3.0
v4.4.0
v4.5.0
v4.5.1
v4.5.2
v5.*
v5.0.0
v5.0.0-alpha.1
v5.0.0-alpha.2
v5.0.0-alpha.4
v5.1.0
v5.10.0
v5.11.0
v5.11.1
v5.11.2
v5.11.3
v5.12.0
v5.12.1
v5.2.0
v5.2.1
v5.2.2
v5.3.0
v5.3.1
v5.3.2
v5.3.3
v5.4.0
v5.5.0
v5.6.0
v5.6.1
v5.6.2
v5.7.0
v5.7.1
v5.7.2
v5.7.3
v5.7.4
v5.8.0
v5.8.1
v5.8.2
v5.8.3
v5.8.4
v5.8.5
v5.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76169.json"