CVE-2026-112362: @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@fastify/expressto a version that resolves this vulnerability.Fixed in 4.0.9 - Configuration
Leave ignoreDuplicateSlashes at its default instead of enabling the non-default option.
Fastify ignoreDuplicateSlashes = default - Configuration
Enforce authentication in a Fastify preHandler hook that runs after the router resolves the request.
Fastify preHandler = authentication enforced
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using @fastify/express versions 4.0.5 through 4.0.8 are affected only when Fastify has the non-default ignoreDuplicateSlashes option enabled. Applications with path-scoped Express middleware protecting routes such as admin endpoints are exposed.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can exploit the issue, and no user interaction is required, by sending an absolute-form request target that causes the Express middleware path check to differ from Fastify's route resolution.
What can be done if an upgrade cannot be applied immediately?
Leave ignoreDuplicateSlashes at its default setting, or enforce authentication in a Fastify preHandler hook that runs after routing resolves the request. This avoids relying on the bypassable path-scoped Express middleware check.
How can I remediate the issue?
Upgrade @fastify/express to version 4.0.9 or later. Review protected routes that rely on path-scoped Express middleware for authentication, authorization, or rate limiting, particularly where ignoreDuplicateSlashes is enabled.