Authentication Bypass in Fastify Plugin of @fastify/auth by Fastify
CVE-2026-92087

8.1HIGH

Key Information:

Vendor

@fastify/auth

Status
@fastify/auth
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92087?

The @fastify/auth plugin, which handles multiple authentication strategies, has a flaw in version 5.0.0 to 5.1.0 that allows an attacker to bypass authentication. When using the 'or' option combined with 'run all', the evaluation of nested AND groups can lead to an improper authorization outcome. An attacker with a valid API key but lacking administrative rights may successfully authenticate if the last check in the group passes. This vulnerability also affects configurations where the top-level relation is set to 'and' with a nested 'or' group. The issue has been resolved in version 5.1.1, and users are advised to upgrade to secure their applications.

Affected Version(s)

@fastify/auth 5.0.0 < 5.1.1

@fastify/auth 5.1.1

References

https://github.com/fastify/fastify-auth/security/advisori...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sengtocxoen
UlisesGascon
mcollina
.