Originally published at HOL

An unauthenticated request with a malformed URL can skip Fastify not-found auth and land in a private sibling plugin fallback. When the request method has no matching route, Fastify internal not-found router used to dispatch bad URLs through a single shared handler pointer before URL decoding. That ignored plugin prefixes and skipped the preHandler declared on setNotFoundHandler . A public prefix could therefore reach a private not-found handler and read its full response. About 12.6 million weekly downloads for the fastify package.

OpenJS shipped the fix in fastify 5.12.2 on 2026-09-04 as a clustered security release. The lead advisory is GHSA-p68q-wchp-6fh7 (CVE-2026-76169). The same tag also closes CVE-2026-84469, CVE-2026-84428, and CVE-2026-84504.

What breaks

Encapsulated apps that put auth on a custom not-found handler under a private prefix are the blast radius for CVE-2026-76169.…