Vendor
@fastify/express
2 known vulnerabilities.
Products
2 results · Clear filters · Feed
-
Critical 9.1
@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL wh…
-
Critical 9.1
@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins
@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so mi…