CVE-2026-76169: Fastify authentication bypass via malformed URLs in encapsulated handlers

CVE-2026-76169 · Severity: high · CVSS 7.5 · Published 2026-09-04

Fastify is a popular Node.js web framework used to build HTTP APIs and web services. A vulnerability in versions 4.0.0 through 5.12.1 allows an attacker to send a malformed URL to a public API endpoint and reach authentication-protected private handlers registered under a different endpoint, bypassing security checks. This could expose sensitive data, tenant information, or private API responses to unauthorized access.

Technologies: fastify (npm). Vendors: npm.

Quick answers

Is CVE-2026-76169 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76169 being exploited in the wild.
How severe is CVE-2026-76169?
High severity, with a CVSS score of 7.5, published 4 September 2026.
Which products and versions are affected?
fastify (npm) >= 4.0.0, < 5.12.2, SEMVER:introduced=4.0.0,fixed=5.12.2.
Is there a fix for CVE-2026-76169?
Yes. fastify (npm): upgrade to 5.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76169 attacked?
It is attacked over the network.
Am I affected by CVE-2026-76169?
Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fastify (npm): upgrade to 5.12.2 or later
    npm install fastify@5.12.2

Technical details

This is an authentication bypass vulnerability (CWE-288) affecting Fastify's internal not-found request router. When a malformed (unparseable) request target is sent to an HTTP method with no registered route, the request reaches Fastify's encapsulated not-found router before URL decoding occurs. The router then dispatches the request through a single shared handler pointer regardless of the plugin prefix, causing it to invoke the most recently registered not-found handler across all prefixes. This skips the preHandler hook declared for the target handler and breaks prefix isolation. An unauthenticated attacker can send a malformed request to a public prefix and reach an authentication-protected not-found handler registered under a private/tenant prefix, receiving its full response. The vulnerability requires network access but no privileges or user interaction. Fastify 5.12.2 patches this by routing malformed URLs through onBadUrl and onMaxParamLength handlers before any application not-found handler runs.

Affected products

  • OpenJS Foundation Fastify >= 4.0.0, < 5.12.2

Identifiers

  • CVE-2026-76169
  • GHSA-p68q-wchp-6fh7

Timeline

  • 2026-09-04: disclosed: CVE-2026-76169 and GHSA-p68q-wchp-6fh7 published
  • 2026-09-04: patched: Patch released in Fastify 5.12.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.