Path Authentication Bypass in Fastify/Express Middleware Affects Fastify Implementation

CVE-2026-33808

What is CVE-2026-33808?

The Fastify/Express middleware in versions v4.0.4 and earlier is susceptible to a vulnerability that permits an unauthenticated attacker to bypass authentication controls. The issue arises from the failure to properly normalize URLs before they are processed by Express middleware, particularly in scenarios where duplicate slashes or semicolon delimiters are involved. When the Fastify router normalization options are enabled, an attacker can exploit this flaw to gain unauthorized access to protected routes. It is crucial for users to upgrade to @fastify/express v4.0.5 or later to mitigate this vulnerability.

References