Read the docs
TI-2026-53284 Aliases CVE-2026-76169GHSA-p68q-wchp-6fh7

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Priority LOW 39CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-288.

Summary

fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0053 45th percentileScored 2026-11-07
Fix Partial fastify (fastify): 5.12.2fastify (npm): 5.12.2Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastifyfastify4.0.0 to before 5.12.25.12.2Patch availableCNA
—fastify (npm)4.0.0 to before 5.12.25.12.2Patch availableGHSA-p68q-wchp-6fh7
  • fastify Vendorfastify Affected 4.0.0 to before 5.12.2 Fixed in 5.12.2 Patch available CNA
  • fastify (npm) Vendor— Affected 4.0.0 to before 5.12.2 Fixed in 5.12.2 Patch available GHSA-p68q-wchp-6fh7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*4.0.0 to before 5.12.2Vulnerablefastify
  • cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 5.12.2 Vulnerable ·fastify

Remediation

  • Fix · CNA fastify (fastify) Fixed in 5.12.2
  • Fix · GHSA-p68q-wchp-6fh7 fastify (npm) Fixed in 5.12.2 Advisory →

Red Hat 4 advisories

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
Show 1 more Red Hat advisories
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    fastify 5.12.2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-58050 fastify vulnerable to request validation bypass via skipped boolean false schemasPriority LOW 39
    • TI-2026-58022 fastify vulnerable to header validation bypass via incomplete schema case normalizationPriority LOW 39
    • TI-2026-58072 fastify vulnerable to request body replacement via an async validation result collisionPriority LOW 38
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Not affected: 4 products
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Dev Spaces 3.31

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76169
  2. 2026-10-03 Alias added: GHSA-p68q-wchp-6fh7
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  6. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  7. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  8. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat

References

Advisory 3

Other 3

  • TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
  • TI-2025-23513 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass CVSS 3.1HIGH 7.5
  • TI-2026-58050 fastify vulnerable to request validation bypass via skipped boolean false schemas CVSS 3.1HIGH 7.5
  • TI-2026-58022 fastify vulnerable to header validation bypass via incomplete schema case normalization CVSS 3.1HIGH 7.5
  • TI-2026-26178 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header CVSS 3.1HIGH 7.5
  • TI-2026-58072 fastify vulnerable to request body replacement via an async validation result collision CVSS 3.1HIGH 8.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences