Path-Matching Vulnerability in Fastify/Express Plugin by Fastify

CVE-2026-6556

What is CVE-2026-6556?

The @fastify/express plugin exhibits a vulnerability whereby middleware attached to non-string mount paths, such as arrays or regular expressions, does not receive the appropriate prefix in prefixed plugin scopes. This can lead to critical bypass scenarios for authentication, authorization, and rate limiting, allowing attackers to access protected routes without executing the necessary middleware checks. Users are advised to upgrade to version 4.0.7 or modify their mount paths to ensure they are strings to mitigate this risk.

References