Skip to content
OpenAdvisories

Product · fastify

fastify-express

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-33807

    @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

    @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middlew…

    fastify fastify-express @fastify/express npm
  • Critical 9.1
    CVE-2026-33808

    @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

    Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when …

    fastify fastify-express @fastify/express npm