Path Traversal Vulnerability in Fastify Plugin for Express Middleware

CVE-2026-112362

What is CVE-2026-112362?

The @fastify/express plugin allows Express middleware to run within Fastify applications. However, in versions 4.0.5 to 4.0.8, a vulnerability arises when the non-default ignoreDuplicateSlashes option is enabled. This configuration can lead to path-scoped Express middleware being bypassed in specific scenarios. Consequently, it permits unauthorized access to sensitive routes without executing essential authentication or authorization checks. To mitigate this risk, users are advised to upgrade to version 4.0.9 or later, or alternatively, implement authentication mechanisms in Fastify hooks that execute after the routing phase.

References