Schecthellraiser606

**Name of the Vulnerable Software and Affected Versions** fastify versions 4.0.0 through 5.12.1 **Description** An unauthenticated attacker can bypass authentication hooks and break prefix encapsulation by sending a malformed URL. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, which ignores the prefix and skips the normal lifecycle of the selected handler. This allows a request sent under one plugin prefix to be routed to the custom not-found handler of a different sibling plugin, potentially allowing the attacker to reach an authentication-protected private fallback and read its full response. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.2 **Description** Fastify incorrectly determines whether to compile a request schema based on JavaScript truthiness. According to JSON Schema Draft 7, a boolean `false` is a valid schema that rejects all instances. However, when `false` is assigned to a route's `body`, `querystring`, `params`, or `headers` schema to deny all input, the software treats it as a missing schema and fails to compile a validator. This allows an unauthenticated remote client to bypass validation and reach handlers intended to be unreachable, potentially leading to unauthorized state changes or the execution of disabled operations. **Recommendations** Upgrade to fastify version 5.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.2 **Description** An issue exists in how HTTP header names are handled during the compilation of a route's header schema. The software attempts to implement the case-insensitive nature of HTTP headers by lowercasing property keys and the root-level required array, but it fails to lowercase the trigger and dependent names within the JSON Schema Draft 7 dependencies keyword. Since Node.js stores request header names in lowercase, dependencies using canonical-case names never match, causing presence assertions to be silently skipped. This allows an unauthenticated remote client to send a header that activates a privileged branch while omitting a required header, thereby bypassing conditional checks. **Recommendations** Upgrade to fastify version 5.12.2 or later.