EUVD-2026-70988Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-exploitable with no auth and low complexity; impact is confidentiality-only since the attacker reads the protected handler response without modifying application state.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
4DescriptionCVE.org
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
AnalysisAI
Authentication hook bypass in Fastify 4.0.0-5.12.1 allows unauthenticated network attackers to reach a private plugin's custom not-found handler by sending a malformed URL under a sibling public plugin's prefix. The internal not-found router dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring plugin-prefix scoping and skipping the preHandler lifecycle - the mechanism most Fastify applications use to enforce JWT or session authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions must exist in the target application: (1) Fastify version 4.0.0-5.12.1 is in use; (2) the application registers at least two sibling plugins under different prefixes using `fastify.register()`, with at least one prefix publicly reachable by the attacker; (3) the private sibling plugin defines a custom not-found handler via `setNotFoundHandler()` and relies on a `preHandler` hook for authentication rather than inline auth logic inside the handler body. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is assessed as accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to Fastify 5.12.2 or later, which corrects the internal not-found router to respect plugin-prefix scoping and invoke the full handler lifecycle - including preHandler hooks - before dispatching 404 responses. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory scan across your infrastructure to identify all Fastify deployments running versions 4.0.0-5.12.1 and document their network exposure and role in your application stack. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all req
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
Fastify is a fast and low overhead web framework, for Node.js. Rated high severity (CVSS 7.5), this vulnerability is rem
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: a
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger reso
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Authorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthent
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authoriza
Fastify is a web framework with minimal overhead and plugin architecture. Rated high severity (CVSS 8.8), this vulnerabi
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today