CVE-2026-76169

Name of the Vulnerable Software and Affected Versions fastify versions 4.0.0 through 5.12.1

Description An unauthenticated attacker can bypass authentication hooks and break prefix encapsulation by sending a malformed URL. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, which ignores the prefix and skips the normal lifecycle of the selected handler. This allows a request sent under one plugin prefix to be routed to the custom not-found handler of a different sibling plugin, potentially allowing the attacker to reach an authentication-protected private fallback and read its full response.

Recommendations Upgrade to fastify version 5.12.2 or later.