Description

fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T10:17:12.020Z",
  "pubdate": "2026-09-04T10:17:12.020Z",
  "executiveSummary": "Fastify versions from 4.0.0 up to 5.12.2 are susceptible to an authentication bypass vulnerability stemming from flawed URL routing and lifecycle handling.\nThe vulnerability allows an unauthenticated attacker to bypass authentication hooks and access restricted, private fallback handlers by crafting malformed URLs.\nThis flaw specifically affects Fastify's internal not-found routing mechanism, which fails to correctly account for plugin prefix encapsulation when dispatching malformed requests.\nBy routing a request sent to a public prefix into a sibling plugin's private not-found handler, the system unintentionally skips the security lifecycle hooks (such as preHandler) that are intended to protect the resource.\nThe impact is significant, as it permits unauthorized access to potentially sensitive information protected by authentication middleware.\nExploitation is trivial and does not require prior authentication, making it a critical risk for applications relying on Fastify's encapsulated plugin structure for access control enforcement.",
  "technicalDetails": "The root cause of this vulnerability lies in the internal handling of malformed URLs within Fastify's routing system. When a request is dispatched, Fastify attempts to route it based on defined prefixes and plugin encapsulation boundaries. However, the internal not-found router, which manages requests that do not match existing route definitions, incorrectly dispatches malformed paths via a single shared handler pointer before URL decoding occurs.\nThis mechanism fails to respect the scope of plugin prefixes. Specifically, a request submitted under a public, non-authenticated plugin prefix can be diverted to the custom not-found handler of a sibling plugin. Crucially, because this dispatch happens outside of the standard request lifecycle, the preHandler hooks associated with the target handler—which typically enforce authentication—are never executed.\nThe attack flow proceeds as follows: An attacker identifies an application using Fastify with multiple plugins, where at least one plugin exposes a public endpoint and another utilizes an authentication-protected custom not-found handler. The attacker submits a malformed URL designed to trigger the routing ambiguity. Due to the failure in the routing dispatch logic, the application routes this malformed request to the restricted handler. Because the execution flow bypasses the hook registration phase of the target plugin, the handler processes the request as if it were a legitimate internal request, returning the full response of the private resource to the unauthenticated attacker.\nThis bypass effectively breaks the encapsulation guarantees provided by Fastify plugins. The affected versions (>= 4.0.0 and < 5.12.2) share this architectural weakness in how the not-found router interacts with the lifecycle manager. The vulnerability is network-exposed by design, as it resides in the core routing engine, meaning any application reachable over HTTP is potentially vulnerable if it uses custom not-found handlers under different prefixes with differing security constraints. Post-exploitation allows an attacker to access sensitive fallback handlers, potentially leading to unauthorized data disclosure or the exposure of internal application state."
}