Executive brief
@fastify/auth is a Fastify plugin used to compose multiple authentication and authorization strategies in a single route guard. In versions 5.0.0–5.1.0, the plugin's logic for combining authentication checks with AND/OR operators can be bypassed by attackers who fail an early check but pass a later one. For example, a user holding a valid API key but lacking admin privileges could gain unauthorized access to restricted features. This affects any application using nested authentication logic and could lead to unauthorized access to sensitive data or administrative functions.
Technical details
The vulnerability is an improper authorization check (CWE-285) in the composition engine that evaluates nested AND/OR authentication strategies. When using { relation: 'or', run: 'all' } with a nested AND array, an earlier failing check can be silently dropped, causing the group's result to depend only on its last member. Similarly, with { relation: 'and' } and a nested OR group, a failing OR group can be masked by a later passing element. An attacker with low privileges (e.g., valid API key) can exploit order-dependent evaluation to bypass stricter checks (e.g., admin verification). The attack requires network access and low-level privileges but no user interaction. The fix is available in version 5.1.1.
Affected products
- OpenJS Foundation @fastify/auth 5.0.0 through 5.1.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 5.1.1