Authentication Bypass Using an Alternate Path or Channel Affecting fastify package, versions >=4.0.0 <5.12.2

fastify is an overhead web framework, for Node.js.

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via malformed URLs in the fourOhFour router in lib/four-oh-four.js. An attacker can reach an encapsulated not-found handler and bypass its preHandler by sending a malformed request target such as /public/%c0 to a sibling plugin prefix when no route matches the request method. Because the malformed URL is routed through the shared not-found dispatch path, Fastify can invoke the wrong plugin’s 404 handler and return its response without running the protected handler’s authentication hook. This breaks prefix-scoped not-found handling and exposes any data or behavior that the private fallback handler would normally guard.

Workarounds

• Reject malformed request targets before they reach the application, for example at an upstream proxy or gateway, to prevent malformed URLs from reaching encapsulated not-found handlers and bypassing their preHandler authentication hooks.
• Do not rely on a not-found handler to serve protected data, so a malformed URL cannot be used to obtain private fallback responses from a sibling plugin’s 404 handler.

• GitHub Commit v5.12.2
• Maintainer's Advisory