Schecthellraiser606

An unauthenticated attacker can bypass authentication hooks and break prefix encapsulation by sending a malformed URL. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, which ignores the prefix and skips the normal lifecycle of the selected handler. This allows a request sent under one plugin prefix to be routed to the custom not-found handler of a different sibling plugin, potentially allowing the attacker to reach an authentication-protected private fallback and read its full response.

Fastify incorrectly determines whether to compile a request schema based on JavaScript truthiness. According to JSON Schema Draft 7, a boolean `false` is a valid schema that rejects all instances. However, when `false` is assigned to a route's `body`, `querystring`, `params`, or `headers` schema to deny all input, the software treats it as a missing schema and fails to compile a validator. This allows an unauthenticated remote client to bypass validation and reach handlers intended to be unreachable, potentially leading to unauthorized state changes or the execution of disabled operations.

An issue exists in how HTTP header names are handled during the compilation of a route's header schema. The software attempts to implement the case-insensitive nature of HTTP headers by lowercasing property keys and the root-level required array, but it fails to lowercase the trigger and dependent names within the JSON Schema Draft 7 dependencies keyword. Since Node.js stores request header names in lowercase, dependencies using canonical-case names never match, causing presence assertions to be silently skipped. This allows an unauthenticated remote client to send a header that activates a privileged branch while omitting a required header, thereby bypassing conditional checks.