fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-76169 affects Fastify web framework versions 4.0.0 through 5.12.2 and allows unauthenticated attackers to bypass security controls through malformed URL routing. The vulnerability exists in the internal not-found router for encapsulated handlers, which dispatches malformed paths before URL decoding and ignores plugin prefixes. This causes requests to reach custom not-found handlers in different sibling plugins without executing their declared preHandler hooks—effectively bypassing authentication and authorization checks. Any application using Fastify plugins with authentication middleware is at risk, particularly those relying on preHandler hooks to enforce access controls across multiple plugin scopes.
While MITRE ATT&CK techniques are not formally mapped to this CVE, Casky's security skills would identify this as an authentication bypass pattern falling under access control evasion. Practitioners using Casky would see detection signals focused on: (1) unexpected cross-plugin request routing, (2) handler invocation without prerequisite lifecycle hooks, and (3) malformed URL patterns reaching protected endpoints. Claude's extended reasoning capabilities would correlate the malformed URL encoding behavior with authentication control gaps, helping teams identify plugin configurations where preHandlers protect sensitive operations. Security practitioners should prioritize updating to Fastify 5.12.2 or later and audit plugin prefix configurations to ensure authentication handlers execute for all request paths, including edge cases with unusual URL encoding.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-76169. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation