Exploit discussion active in current signal (4 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
A weird URL can walk past the not-found auth on your Fastify app and pull data from a private fallback you thought was locked. Upgrade fastify to 5.12.2. CVE-2026-76169 https://hol.org/blog/cve-2026-76169-fastify-malformed-url-not-found-auth-bypass https://t.co/WLcov4Rf1T
Post summary
Fastify’s CVE-2026-76169 permits an authentication bypass through a malformed URL; upgrading to version 5.12.2 mitigates the vulnerability.
🚨 High-severity security fix in fastify@5.12.2 just released! Patches CVE-2026-76169: authentication bypass via malformed URLs reaching encapsulated not-found handlers. https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7
Post summary
Fastify version 5.12.2 has released a patch for CVE-2026-76169, an authentication bypass caused by malformed URLs that reach hidden not‑found handlers. No PoC or exploitation activity was reported.
THREATLOOM // RESEARCH Fastify just patched an auth bypass that’s more interesting than the 7.5 score suggests. CVE-2026-76169 lets a malformed URL cross plugin-prefix boundaries and hit a sibling setNotFoundHandler() without its preHandler auth hook running. Important: Fastify says a global onRequest auth hook does not save you here — the malformed-URL path skips the normal lifecycle. Fixed in 5.12.2. Until upgraded, reject malformed request targets at the proxy/gateway and don’t serve protected data from not-found handlers. The defensive lesson: framework encapsulation and middleware ordering are security boundaries too. https://github.com/fastify/fastify/security/advisories/GHSA-p68q-wchp-6fh7 https://cna.openjsf.org/security-advisories.html
Post summary
Fastify disclosed CVE-2026-76169—a malformed URL auth bypass—and released a patch in version 5.12.2, recommending interim mitigations.
CVE-2026-76169 fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and … https://www.cve.org/CVERecord?id=CVE-2026-76169
Post summary
The text discloses that Fastify versions 4.0.0 through 5.12.1 contain a URL routing flaw that can redirect malformed requests to a sibling plugin’s custom not‑found handler.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify | - | node.js | - |