CVE-2026-76169

Executive Summary

CVE-2026-76169 is a routing and encapsulation bypass vulnerability in the Fastify Node.js web framework affecting versions 4.0.0 through 5.12.1. A malformed URL submitted under one plugin's prefix can be routed to the custom not-found (private fallback) handler of a different sibling plugin and invoked without that handler's declared preHandler hook. This allows an unauthenticated attacker to reach authentication-protected fallback handlers through an unrelated public prefix, exposing the full response body and breaking Fastify's plugin encapsulation model, which is a core security boundary for multi-tenant and modular applications.

Technical Analysis

Fastify's plugin system provides encapsulation: routes, hooks, and error/not-found handlers registered inside one plugin prefix should not be reachable from sibling or parent scopes. This isolation is a fundamental assumption for developers who mount authentication preHandlers at a plugin boundary and assume any handler reached through that prefix has passed authentication.

Per the NVD description, the vulnerable code path is the internal not-found router for encapsulated handlers. It is described as dispatching malformed paths through a single shared handler pointer before URL decoding. This timing is significant: URL decoding normally occurs before routing decisions in correct implementations, but in the affected versions the malformed path is first matched against a shared not-found handler pointer. Because the pointer is shared and evaluated before the URL is decoded, the router ignores the caller's plugin prefix when selecting the handler. Consequently, a request sent to public prefix A can be matched against the custom not-found handler that was registered inside authentication-protected sibling plugin B.

Two distinct security properties are violated:

1. Prefix encapsulation bypass (CWE-288 / Authentication Bypass Using an Alternate Path or Channel). The prefix that the request targets (public) does not correspond to the plugin whose handler actually executes (protected sibling).

2. Hook lifecycle skip. Once the wrong handler is selected through the shared pointer, the selected handler's normal lifecycle — including its registered preHandler hook — is not executed. The description explicitly states the invocation occurs "without the preHandler hook declared for that handler." So even if a developer decorated the protected fallback with an authentication preHandler, that hook never runs, and no auth check is applied.

The net effect: an unauthenticated remote actor crafts a URL that is deliberately malformed (to enter the pre-decoding dispatch branch) and sent under a public prefix, and the response returned is the body produced by the private, auth-protected fallback handler of a sibling plugin.

The public CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. 7.5 HIGH. The integrity and availability impacts are rated NONE because the flaw is a confidentiality leak (reading the protected handler's response), not a data-modification or denial-of-service primitive. No scope change is assessed (S:U), although the practical effect is a crossing of the application's internal plugin trust boundary.

The affected range is broad: every Fastify 4.x release and every 5.x release prior to 5.12.2. Because Fastify is a foundational library, exposure depends on whether the deployed application both (a) uses encapsulated plugins with custom not-found handlers, and (b) places those handlers behind authentication hooks. Applications that rely on prefix-scoped auth preHandlers to shield private fallbacks are the primary victims.

Exploitation Scenarios

No public proof-of-concept exists for this CVE; the attack chain below is inferred strictly from the vulnerability class and the NVD description. No specific function, file, or parameter names beyond those stated in the source text are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet-facing application built on Fastify within the affected range. Passive signals include x-powered-by: fastify response headers, Fastify-specific error/404 response bodies, and framework fingerprints. The attacker then maps at least one public plugin prefix (an unauthenticated surface) and infers or guesses that a sibling plugin registered on the same server exposes a custom not-found handler containing sensitive content and guarded by an authentication preHandler.

2. Triggering the flaw class. The attacker issues a request whose path is URL-encoded or otherwise malformed so that it reaches the internal not-found router's shared-dispatch branch before URL decoding completes, and targets that request at the public prefix. Because the shared handler pointer is consulted before decoding and prefix resolution is skipped for malformed paths, the request is routed to the protected sibling's custom not-found handler rather than to the public plugin's own fallback.

3. Execution method. No payload payload injection or code execution is required — the exploit is entirely a routing/misrouting condition. The malformed-URL HTTP request itself causes the protected handler to be invoked. Critically, the handler's preHandler hook (the authentication check) is not run as part of this abnormal dispatch path, so the request proceeds directly to the handler body without identity verification.

4. Post-exploitation impact. The attacker receives the full HTTP response generated by the authentication-protected private fallback handler. If that fallback returns sensitive data (internal diagnostics, environment or configuration metadata, stack traces, business data, or links to further internal endpoints), the data is disclosed. The attacker learns that a specific private plugin exists and can be reached cross-prefix, which can seed further targeted probing. Because the read is unauthenticated and repeatable, an adversary can harvest fallback responses from multiple sibling plugins at will. No write/delete/DoS impact is described; the CVSS vector reflects confidentiality-only impact.

Impact Assessment

• Confidentiality — HIGH (C:H). The vulnerability's core effect is unauthorized disclosure of an authentication-protected handler's full response body. Because the handler can contain application-specific sensitive content, the ceiling of what can be leaked is set by whatever the developer chose to return from private fallbacks.
• Integrity — NONE (I:N). No data modification is described.
• Availability — NONE (A:N). No disruption primitive is described.
• Exploitability — HIGH. AV:N / AC:L / PR:N / UI:N means no privileges, no user interaction, no special conditions; a single malformed HTTP request from any network position suffices.
• Blast radius. Any Fastify application in the affected range that uses encapsulated plugins with custom not-found handlers behind auth hooks. This pattern is common in modular or multi-tenant APIs where each plugin represents a functional or tenant boundary. A single exposed sibling fallback can leak that plugin's content to every unauthenticated client.
• Threat intelligence posture. EPSS is 0.00508 (42.1st percentile), indicating currently low predicted exploitation activity; CISA KEV does not list it; no public PoC, Nuclei template, or exploit code was reported. As an unauthenticated, low-complexity info-leak in an extremely popular framework, however, weaponization risk may rise once public details spread.

Detection Guidance

Sigma Rule

title: Fastify CVE-2026-76169 Malformed URL Prefix Encapsulation Bypass
id: 8b2f2c4e-1a7d-4c61-9d2e-76169fastify
status: experimental
description: Detects requests using heavily percent-encoded or malformed paths that may trigger Fastify's shared not-found router dispatch before URL decoding, bypassing plugin prefix encapsulation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76169
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_ua:
    cs-method:
      - GET
      - POST
      - HEAD
  selection_malformed:
    cs-uri-stem|re: '(%25){2,}|%2f|%2e%2e|%00|%c0%af|%ef%bc%8f'
  selection_notfound:
    cs-uri-stem|endswith:
      - '/404'
      - '/not-found'
  condition: selection_ua and selection_malformed
falsepositives:
  - Legitimate clients double-encoding reserved characters
  - Security scanners and fuzzing tools
level: medium
tags:
  - attack.t1190
  - cve.2026.76169

YARA Rule

rule CVE_2026_76169_Fastify_Malformed_URL_Bypass
{
    meta:
        description = "Detects malformed double-encoded or pre-decode path traversal strings in HTTP request artifacts targeting Fastify CVE-2026-76169"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76169"
        severity = "high"

    strings:
        $m1 = "%252f" nocase
        $m2 = "%252e" nocase
        $m3 = "%00" nocase
        $m4 = "%c0%af" nocase
        $m5 = "%ef%bc%8f" nocase
        $notfound = "/not-found" nocase ascii

    condition:
        (any of ($m*)) and filesize < 5KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76169 Fastify Malformed URL Not-Found Handler Encapsulation Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(?:%25){2,}|%252f|%252e|%00|%c0%af|%ef%bc%8f/i"; http.header; content:"Host"; reference:cve,2026-76169; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76169; classtype:attempted-recon; sid:202676169; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Medium;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method in ("GET","POST","HEAD")
    and wildcard(http.request.uri, "*%25*")
    and wildcard(http.request.uri, "*%00*") ]
  [ network where http.response.status_code in (404, 200)
    and wildcard(url.path, "*not-found*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=fastify
| eval mpath=lower(uri)
| where (match(mpath, "%25%25") OR match(mpath, "%252f") OR match(mpath, "%252e") OR match(mpath,"%00") OR match(mpath,"%c0%af") OR match(mpath,"%ef%bc%8f"))
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, uri, host
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,fastify,cve-2026-76169">
  <rule id="576169" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>%25%25|%252f|%252e|%00|%c0%af|%ef%bc%8f</url>
    <description>CVE-2026-76169: Fastify malformed URL targeting encapsulated not-found handler (potential prefix encapsulation bypass)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_76169,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — independently confirmed by NVD and OSV).

1) Immediate mitigations (if upgrade is not immediately possible):

• Do not rely on plugin-prefix encapsulation alone to protect sensitive not-found handlers. Add explicit authentication inside the custom not-found handler body itself (e.g., re-check the session/token within the handler), so the response is empty/redirecting unless authenticated — do not depend solely on preHandler.
• Return minimal, non-sensitive content from custom not-found handlers. Avoid internal diagnostics, configuration, stack traces, or business data in fallback responses.
• Front the application with a WAF/proxy that rejects malformed, multiply-percent-encoded, or null-byte paths before they reach Fastify.
• Monitor access logs for malformed/encoded paths when the description indicates only such requests can trigger the pre-decode dispatch branch.

2) Patch / upgrade steps:

• Upgrade Fastify to 5.12.2 or later (addresses the affected range >= 4.0.0 and before 5.12.2).
• Because Fastify is a transitive dependency of many frameworks and plugins, audit package.json/lockfiles for the resolved Fastify version and force-upgrade transitive installs (npm ls fastify, npm audit, overrides/resolutions blocks as needed).
• Redeploy and verify the running version via require('fastify/package.json').version.

3) Long-term hardening:

• Treat plugin encapsulation as a defense-in-depth layer, not as an authorization control. Enforce authentication and authorization on the response itself.
• Add regression tests asserting that a sibling plugin's private fallback cannot be reached via a public prefix using malformed/encoded paths.
• Adopt SCA/pinning dependencies, subscribe to Fastify security advisories, and maintain a rapid patch cadence for web framework dependencies.
• Keep WAF rules current for path-encoding anomalies as a compensating control.

References

• NVD — CVE-2026-76169: https://nvd.nist.gov/vuln/detail/CVE-2026-76169
• OSV — Fastify advisory entry tracking the unfixed range and fix: https://osv.dev/vulnerability/CVE-2026-76169
• Fastify official documentation on plugin encapsulation and hooks: https://fastify.dev/docs/latest/Reference/Encapsulation/
• Fastify GitHub releases (verify 5.12.2 onward): https://github.com/fastify/fastify/releases
• MITRE CWE-288 — Authentication Bypass Using an Alternate Path or Channel: https://cwe.mitre.org/data/definitions/288.html

Threat actor / in-the-wild status: No evidence of exploit-in-the-wild activity. CISA KEV: NO. No public PoC, Nuclei template, or exploit code was identified at the time of writing. EPSS 0.00508 (42.1st percentile) indicates low current exploitation likelihood, though the unauthenticated, low-complexity nature of the flaw warrants timely patching.