@fastify/auth vulnerabilities

Products

• @fastify/auth 1

Latest @fastify/auth CVEs

Newest publication first

1. CVE-2026-92087 @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth

   Published 2026-09-16

   High·CVSS 8.1

   @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation "or" option together with the run "all" option and one entry is a nested...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.