Read the docs
TI-2026-26179 Aliases CVE-2026-33807GHSA-hrwm-hgmj-7p9c

@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

Priority HIGH 80CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match incoming requests. This results in complete bypass of Express middleware security controls, including authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. No special configuration or request crafting is required. Upgrade to @fastify/express v4.0.5 or later.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed @fastify/express (fastify): 4.0.5@fastify/express (npm): 4.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastify@fastify/expressbefore 4.0.54.0.5Patch availableCNA
—@fastify/express (npm)before 4.0.54.0.5Patch availableGHSA-hrwm-hgmj-7p9c
  • @fastify/express Vendorfastify Affected before 4.0.5 Fixed in 4.0.5 Patch available CNA
  • @fastify/express (npm) Vendor— Affected before 4.0.5 Fixed in 4.0.5 Patch available GHSA-hrwm-hgmj-7p9c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify\/express:*:*:*:*:*:node.js:*:*before 4.0.5Vulnerablefastify
  • cpe:2.3:a:fastify:fastify\/express:*:*:*:*:*:node.js:*:* Versions before 4.0.5 Vulnerable ·fastify

Remediation

  • Fix · CNA @fastify/express (fastify) Fixed in 4.0.5
  • Fix · GHSA-hrwm-hgmj-7p9c @fastify/express (npm) Fixed in 4.0.5 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    fastify @fastify/express 4.0.5

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2026-26180 @fastify/express vulnerable to middleware authentication bypass via URL normalization…Priority HIGH 80
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33807
  2. 2026-10-03 Alias added: GHSA-hrwm-hgmj-7p9c

References

Exploit 1

Advisory 2

Other 1

  • TI-2026-26180 @fastify/express vulnerable to middleware authentication bypass via URL normalization… CVSS 4.0CRITICAL 9.1
  • TI-2026-05746 @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences