Is CVE-2026-92087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92087 being exploited in the wild.

How severe is CVE-2026-92087?

High severity, with a CVSS score of 8.1, published 16 September 2026.

Which products and versions are affected?

OpenJS Foundation @Fastify/Auth 5.0.0 through 5.1.0.

Is there a fix for CVE-2026-92087?

A patch was published on 2026-09-16: Fixed in version 5.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92087 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92087?

Check whether you run OpenJS Foundation @Fastify/Auth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92087: @fastify/auth authorization bypass via order-dependent evaluation

CVE-2026-92087 · Severity: high · CVSS 8.1 · Published 2026-09-16

@fastify/auth is a Fastify plugin used to compose multiple authentication and authorization strategies in a single route guard. In versions 5.0.0–5.1.0, the plugin's logic for combining authentication checks with AND/OR operators can be bypassed by attackers who fail an early check but pass a later one. For example, a user holding a valid API key but lacking admin privileges could gain unauthorized access to restricted features. This affects any application using nested authentication logic and could lead to unauthorized access to sensitive data or administrative functions.

Vendors: OpenJS Foundation.

Quick answers

Is CVE-2026-92087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92087 being exploited in the wild.
How severe is CVE-2026-92087?: High severity, with a CVSS score of 8.1, published 16 September 2026.
Which products and versions are affected?: OpenJS Foundation @Fastify/Auth 5.0.0 through 5.1.0.
Is there a fix for CVE-2026-92087?: A patch was published on 2026-09-16: Fixed in version 5.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92087 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92087?: Check whether you run OpenJS Foundation @Fastify/Auth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authorization check (CWE-285) in the composition engine that evaluates nested AND/OR authentication strategies. When using { relation: 'or', run: 'all' } with a nested AND array, an earlier failing check can be silently dropped, causing the group's result to depend only on its last member. Similarly, with { relation: 'and' } and a nested OR group, a failing OR group can be masked by a later passing element. An attacker with low privileges (e.g., valid API key) can exploit order-dependent evaluation to bypass stricter checks (e.g., admin verification). The attack requires network access and low-level privileges but no user interaction. The fix is available in version 5.1.1.

Affected products

OpenJS Foundation @fastify/auth 5.0.0 through 5.1.0

Timeline

2026-09-16: disclosed
2026-09-16: patched: Fixed in version 5.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.