EUVD-2026-110753Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify scoped route behind Express middleware
-
DeliveryCraft absolute-form HTTP request target
-
ExploitNormalization collapses scheme separator, router resolves scoped path
-
ExecutionHandler executes, Express auth middleware skipped
-
ImpactReach protected admin functionality unauthenticated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
| Exploitation Conditions | Exploitation requires three specific conditions: (1) Fastify is started with the non-default routerOptions.ignoreDuplicateSlashes:true - the default (off) is not vulnerable; (2) the application protects routes using path-scoped Express middleware mounted via @fastify/express, e.g. app.use('/admin', authMiddleware) for authentication, authorization, or rate limiting; and (3) the attacker sends an absolute-form request target (e.g. GET http://host/admin/dashboard) whose scheme separator is collapsed by duplicate-slash normalization. The decisive LIMITING factor is the non-default configuration: deployments that leave ignoreDuplicateSlashes at its default, or that enforce auth in a Fastify preHandler hook running after router resolution, are not exploitable. Affected plugin versions are @fastify/express 4.0.5 through 4.0.8. |
| Impact | This is a genuine high-priority access-control bypass, not an inflated-CVSS artifact - but its real-world reach is gated by one specific deployment choice. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1) describes a remote, unauthenticated, low-complexity attack against confidentiality and integrity, and the vuln.today Decision label is act_now, so this should be treated as urgent for affected deployments. However, the attack is only reachable when Fastify runs with the non-default routerOptions.ignoreDuplicateSlashes:true; the GHSA advisory confirms default configurations (option off) are not exploitable, which is the single biggest limiter on real-world blast radius. No EPSS score and no CISA KEV entry are present in the input, and exploitation status is: no public exploit identified at time of analysis (the two references are the GHSA advisory and the openjsf CNA page, not working exploit code). The signals are therefore consistent rather than conflicting: act_now priority plus a clean CVSS:9.1 bypass, tempered by a non-default-config precondition and absence of KEV/EPSS/PoC evidence, which points to a patch-urgently-but-not-yet-mass-exploited posture. |
| Exploit ScenarioDerived | An application mounts path-scoped Express middleware for protection, e.g. app.use('/admin', authMiddleware), while Fastify is configured with ignoreDuplicateSlashes:true. An unauthenticated remote attacker sends an absolute-form request target such as GET http://host/admin/dashboard; duplicate-slash normalization collapses the separator after the scheme, so Fastify's find-my-way router resolves the request to /admin/dashboard and runs the handler while the Express layer never sees that path and skips the auth/authorization/rate-limiting middleware. No public exploit code is identified in the input, though the mechanism is fully documented in the vendor advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A path-scoped middleware bypass in @fastify/express 4.0.5 through 4.0.8 lets an unauthenticated remote attacker reach handlers protected by Express middleware such as authentication, authorization, or rate limiting. The flaw only manifests when Fastify is started with the non-default routerOptions.ignoreDuplicateSlashes: true and a request is sent with an absolute-form target (e.g. GET http://host/admin/dashboard), which the Fastify router normalizes and dispatches to the scoped handler while the Express layer no longer sees the scoped path. Exploitation is gated by that specific configuration plus reliance on path-scoped Express middleware; no public exploit code or CISA KEV entry was identified in the supplied data, though the vendor rates it CVSS 9.1 and priority guidance is act_now. Fixed in 4.0.9.
RemediationAI
Upgrade @fastify/express to 4.0.9 or later, which is the vendor-released fix per GHSA-6h42-57hq-9746; patch availability is confirmed by the vendor. Two documented workarounds exist if upgrading must be deferred: enforce authentication and authorization in a Fastify hook such as preHandler that runs after the router has resolved the request, which restores enforcement but requires reworking any Express-only middleware logic, or leave routerOptions.ignoreDuplicateSlashes at its default (off), which removes the vulnerable normalization path but changes routing behavior for applications that legitimately relied on duplicate-slash tolerance. Because the flaw is an access-control bypass on scoped routes such as /admin, also audit existing Express-mounted middleware for paths that would be reachable via absolute-form targets. Advisory: https://github.com/fastify/fastify-express/security/advisories/GHSA-6h42-57hq-9746.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
@fastify/express is a Fastify plugin that runs Express middleware inside a Fastify application, bridging two independent routing layers. Under the hood Fastify dispatches through find-my-way, while the Express/middie layer decides which path-scoped middleware applies. The root cause is CWE-436 (Interpretation Conflict): with routerOptions.ignoreDuplicateSlashes enabled, duplicate-slash normalization also collapses the '//' following the scheme in an absolute-form request target, so find-my-way resolves the target to its path and runs the scoped handler, while the Express layer no longer matches that same path and skips the mounted middleware. The result is a disagreement between the two layers on the canonical path. The vulnerable range is npm package @fastify/express >= 4.0.5, < 4.0.9 (CPE cpe:2.3:a:@fastify/express:@fastify/express). The advisory notes this normalization was introduced by the fix for the related middleware bypass GHSA-6hw5-45gm-fj88 (CVE-2026-33808), and the same absolute-form bypass also affects @fastify/middie as GHSA-hx87-8wv7-pjv8 (CVE-2026-85184). The trigger requires the non-default ignoreDuplicateSlashes option; deployments at the default are not affected.
Know when Fastify Express gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote unauthenticated attacker (AV:N/PR:N/UI:N) reliably bypasses middleware once the non-default option is set (a deployment precondition, not attacker complexity, so AC:L); bypass yields read/write to protected handlers (C:H/I:H), no availability impact (A:N).
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.
Technical POC Analysis
Bug class: CWE-436, Interpretation Conflict.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-112362 is a critical authentication bypass in the @fastify/express middleware adapter that allows unauthenticated attackers to reach protected application endpoints. Organizations using affected versions (4.0.5-4.0.8) with the non-default routerOptions.ignoreDuplicateSlashes: true are exposed, meaning any user authentication or authorization relying on Express middleware could be circumvented. Leadership should prioritize remediation because this flaw directly undermines access controls and could lead to unauthorized data access or account takeover.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Fastify Express
View allAuthorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthent
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authoriza
Exploit-DB