Vulnerabilities

TI-2026-05746 CVE-2026-6556

@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

MEDIUM 48

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00522 Published 2026-06-30 Fixed in 4.0.7 CWE-285

TI-2026-26179 CVE-2026-33807 · GHSA-hrwm-hgmj-7p9c

@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

HIGH 80

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0043 Published 2026-04-15 Fixed in 4.0.5 CWE-436

TI-2026-26180 CVE-2026-33808 · GHSA-6hw5-45gm-fj88

@fastify/express vulnerable to middleware authentication bypass via URL normalization…

HIGH 80

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00483 Published 2026-04-15 Fixed in 4.0.5 CWE-436

Vulnerabilities

Filters

@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

@fastify/express vulnerable to middleware authentication bypass via URL normalization…