Fastify CVE-2026-76169

Three concurrent conditions must exist in the target application: (1) Fastify version 4.0.0-5.12.1 is in use; (2) the application registers at least two sibling plugins under different prefixes using fastify.register(), with at least one prefix publicly reachable by the attacker; (3) the private sibling plugin defines a custom not-found handler via setNotFoundHandler() and relies on a preHandler hook for authentication rather than inline auth logic inside the handler body. If the private plugin has no custom not-found handler, or if authentication is enforced inside the handler function itself rather than as a preHandler hook, the bypass does not apply. The attacker requires no credentials, no prior session state, and no user interaction - only network access to the public plugin's prefix and the ability to send a malformed URL path.

The vendor CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is assessed as accurate. The attack is network-reachable, requires no authentication or user interaction, and yields full confidentiality loss from the private handler's response. The practical attack surface is narrowed by the required application architecture: both a publicly-accessible plugin prefix and a private sibling plugin with a custom not-found handler whose authentication is implemented exclusively as a preHandler hook must coexist. This is not an exotic configuration - it is precisely the pattern Fastify's documentation promotes for role-separated APIs - so the affected population is non-trivial. No CISA KEV listing and no POC are present in the input data, and EPSS data is absent, so exploitation frequency cannot be quantified. However, the low complexity and zero-privilege requirement mean that once the pattern is known, mass scanning for vulnerable endpoints is straightforward. The fix is a targeted upgrade with no breaking changes noted, making prompt remediation the clear priority rather than workaround-reliance.

An attacker identifies a Fastify application where a private plugin registered under /api/internal has a custom not-found handler protected by a preHandler JWT-validation hook. The attacker sends a crafted malformed URL - such as a path with invalid percent-encoding - under the public sibling prefix /api/public/%invalid/resource. The not-found router resolves the shared handler pointer before URL decoding and dispatches the request to the private plugin's not-found handler, bypassing the JWT hook entirely. The private handler returns an internal API schema or sensitive error payload, which the unauthenticated attacker reads in full.