CVE-2026-33808: @fastify/express Authentication Bypass via URL Normalization Gaps

Background

The @fastify/express package is a Fastify plugin that allows developers to use Express middleware within Fastify applications. It provides a seamless integration of Express's robust middleware capabilities while benefiting from Fastify's performance and features. However, a vulnerability exists in version 4.0.4 that allows attackers to bypass authentication mechanisms due to improper URL normalization.

Vulnerability Detail

The vulnerability arises from @fastify/express failing to normalize URLs before passing them to Express middleware when certain Fastify router options are enabled. This can lead to a complete bypass of path-scoped authentication middleware. Attackers can exploit this by sending requests with duplicate slashes or semicolon delimiters, which are not correctly handled, allowing unauthorized access to protected routes. The issue is particularly critical as it affects applications relying on Express middleware for authentication, potentially exposing sensitive data and functionalities.

npm install @fastify/express@4.0.5

Workaround

As a temporary workaround, you can manually normalize URLs in your Express middleware before processing requests. Here is an example of how to implement this in your Express middleware:

app.use('/admin', function(req, res, next) {
  req.url = req.url.replace(/\/\//g, '/'); // Normalize duplicate slashes
  req.url = req.url.split(';')[0]; // Strip semicolon-delimited parameters
  next();
});

Conclusion

CVE-2026-33808 represents a significant security risk for applications using @fastify/express version 4.0.4. It is crucial for developers to update to the patched version 4.0.5 to mitigate the risk of authentication bypass and protect sensitive application data.

See every vulnerability recorded for @fastify/express →

FAQ