A vulnerability in Fastify versions >= 4.0.0 and before 5.12.2 allows malformed URLs to be routed to a different sibling plugin's custom not-found handler, bypassing the preHandler hook. The internal not-found router dispatches malformed paths through a shared handler pointer before URL decoding, ignoring plugin prefixes and skipping normal lifecycle hooks. An unauthenticated attacker can exploit this to reach authentication-protected private fallback handlers via an unrelated public prefix, reading full responses without authentication. This breaks plugin prefix encapsulation and effectively bypasses authentication controls. The fix is to upgrade to Fastify 5.12.2 or later.
