Path Handling Flaw in @fastify/express Affects Middleware Security

CVE-2026-33807

What is CVE-2026-33807?

In @fastify/express versions prior to 4.0.5, a path handling bug exists within the onRegister function. This flaw can lead to a doubling of middleware paths when inherited by child plugins. If a child plugin is registered with a prefix that matches an existing middleware path, this path is mistakenly prefixed again. Consequently, incoming requests fail to match the affected middleware, resulting in a bypass of crucial security controls including authentication, authorization, and rate limiting across all affected child plugin routes. To mitigate this issue, users are advised to upgrade to @fastify/express version 4.0.5 or a later release.

References