Vvvvvvvvvvitel

**Name of the Vulnerable Software and Affected Versions** fastify versions 4.0.0 through 5.12.1 **Description** An unauthenticated attacker can bypass authentication hooks and break prefix encapsulation by sending a malformed URL. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, which ignores the prefix and skips the normal lifecycle of the selected handler. This allows a request sent under one plugin prefix to be routed to the custom not-found handler of a different sibling plugin, potentially allowing the attacker to reach an authentication-protected private fallback and read its full response. **Recommendations** Upgrade to fastify version 5.12.2 or later.