Routing Vulnerability in fastify Affecting Plugin Encapsulation

CVE-2026-76169

What is CVE-2026-76169?

A vulnerability in fastify affects versions from 4.0.0 up to, but not including, 5.12.2, where attackers can exploit a flaw in the plugin routing mechanism. This issue arises when a malformed URL is processed through one plugin's prefix, allowing it to invoke the not-found handler of an unrelated sibling plugin. The inadequacy of the preHandler hook enables the attacker to bypass authentication protocols, potentially gaining access to protected resources via public routes. Users are urged to upgrade to fastify version 5.12.2 or later to mitigate this risk.

References