CVE-2026-22037: @fastify/express URL Encoding Bypass Vulnerability
Summary
CVE-2026-22037: @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding). Affects @fastify/express versions < 4.0.3. Fixed in 4.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @fastify/express package is a Fastify plugin that enables the use of Express-style middleware in Fastify applications. It allows developers to leverage existing Express middleware while benefiting from Fastify's performance and features. However, a vulnerability exists that allows attackers to bypass middleware protections using URL-encoded characters.
Vulnerability Detail
A security vulnerability exists in @fastify/express where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., /%61dmin instead of /admin). The middleware engine fails to match the encoded path, allowing attackers to access protected endpoints without the middleware constraints. This vulnerability arises from the way @fastify/express matches requests against registered middleware paths, leading to unauthorized access to sensitive routes.
How To Fix
Minimum fixed version
4.0.3
This is the first release that contains the fix.
npm install @fastify/express@4.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify your middleware to explicitly handle URL-encoded paths or implement additional validation checks to prevent unauthorized access. However, the best solution is to update to the patched version.
Conclusion
The @fastify/express package has a critical vulnerability that allows attackers to bypass middleware protections through URL-encoded characters. It is essential to update to version 4.0.3 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor your applications for such vulnerabilities.
See every vulnerability recorded for @fastify/express →
FAQ
The vulnerability allows attackers to bypass middleware protections by using URL-encoded characters, leading to unauthorized access to sensitive routes.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring access to the code.
The CVSS score of this vulnerability is 8.4, indicating a high severity level.
If you cannot update the package immediately, consider implementing additional validation checks in your middleware to prevent unauthorized access as a temporary measure.
Yes, this vulnerability is specific to the @fastify/express package and differs from other vulnerabilities in different npm modules.
References
Related vulnerabilities
Recent vulnerabilities recorded for @fastify/express.
