Fastify Express Middleware Bypass (CVE-2026-112362)

The plugin lets Express middleware run inside Fastify. The maintainer says a URL handling mismatch can let an unauthenticated attacker skip checks on a scoped path. These checks can include authentication, authorization, or rate limiting. The CVSS vector lists network access, low attack complexity, no privileges, and no user interaction.

Fastify and the Express layer can read the same request target in different ways. With ignoreDuplicateSlashes enabled, the plugin also collapses the scheme separator in an absolute-form target. Fastify still resolves the target to its path and runs the route handler. The Express layer no longer sees the scoped path, so its middleware does not run.

This is a route protection bypass, not a claim that every Fastify app is exposed. The advisory requires the non-default router option and an affected plugin release. A version check alone misses the setting that makes this path reachable. Review where each app enforces access checks.

For wider context, our developer security guide covers secure coding practice. See also our 2025 CWE Top 25 analysis and H1 2026 vulnerability exploitation trends.

For a different proxy access-control issue, see our Echo WebSocket route access bypass profile.

The affected npm package is @fastify/express, versions 4.0.5 through 4.0.8. The required setting is routerOptions.ignoreDuplicateSlashes: true. Its default is off. The maintainer lists 4.0.9 as the patched release and advises upgrading to 4.0.9 or later.

The scope is path-scoped Express middleware in the affected setup. The maintainer describes an admin route whose handler still runs while its auth middleware is skipped. It also names authorization and rate limiting as checks that can be bypassed. This does not establish code execution or observed attacks.

The advisory links the bug to the earlier @fastify/express bypass CVE-2026-33808. It says the fix for that issue introduced the affected normalization. It also points to CVE-2026-85184, a related absolute-form bypass in @fastify/middie. Those references do not change the affected package or fixed version for CVE-2026-112362.