CVE-2026-112362: @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-27 · updated 2026-10-27
Weakness: CWE-436

Description

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.

Summary

@fastify/express versions 4.0.5 through 4.0.8 can skip path-scoped Express middleware when Fastify's non-default ignoreDuplicateSlashes option is enabled. An absolute-form request target can reach a scoped route, such as an admin path, while authentication, authorization, or rate-limiting middleware is bypassed, allowing unauthenticated access. CVSS is 9.1 (critical); no known exploitation in CISA KEV. Upgrade to @fastify/express 4.0.9 or later, or enforce authentication in a Fastify preHandler hook and leave ignoreDuplicateSlashes at its default.

تسمح إصدارات @fastify/express من 4.0.5 إلى 4.0.8 بتجاوز برمجيات Express الوسيطة المرتبطة بمسار معيّن عندما يكون خيار ignoreDuplicateSlashes غير الافتراضي مفعّلًا في Fastify. ويمكن لطلب يستخدم هدفًا مطلقًا (absolute-form) أن يصل إلى مسار محدد مثل مسار الإدارة مع تخطي وسائط المصادقة أو التفويض أو تحديد المعدل، ما يتيح وصولًا دون مصادقة. درجة CVSS هي 9.1 (حرجة)، ولا يوجد استغلال معروف في CISA KEV. يجب الترقية إلى @fastify/express 4.0.9 أو أحدث، أو فرض المصادقة عبر خطاف preHandler في Fastify مع إبقاء ignoreDuplicateSlashes على قيمته الافتراضية.

Affected products

@fastify/express: from 4.0.5 before 4.0.9 — fixed in 4.0.9

How to fix

Upgrade to a fixed version: @fastify/express 4.0.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-112362 or the next vulnerability affects your stack