EUVD-2026-22880
GHSA-hrwm-hgmj-7p9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Fastify app with fastify/express
-
DeliverySend unauthenticated HTTP request to protected route
-
ExploitMiddleware fails to match due to doubled path
-
ExecutionAccess protected resource without authentication
-
ImpactExfiltrate sensitive data or modify application state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
| Exploitation Conditions | Requires @fastify/express v4.0.4 or earlier installed. Attacker must register a child plugin with a prefix matching an existing middleware path. No authentication, user interaction, or special configuration required. Remote unauthenticated exploitation bypasses all inherited Express middleware security controls (authentication, authorization, rate limiting) for affected child plugin routes. |
| Impact | Real-world risk is critically high despite no confirmed active exploitation (CISA KEV status negative). The CVSS 9.1 score accurately reflects severity through multiple high-risk factors: network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high confidentiality/integrity impact (C:H/I:H). EPSS data not provided, but exploitation probability should be considered elevated given: (1) the vulnerability activates through normal plugin usage patterns without attacker crafting, (2) authentication/authorization bypass enables immediate escalation to protected resources, (3) Fastify's popularity in Node.js microservices architectures creates broad exposure, and (4) the technical simplicity-developers need only configure child plugins with matching prefixes. SSVC assessment: Exploitation status is POC-equivalent (developers can trivially reproduce via standard configuration), automatable (yes-no human decision points in exploitation), technical impact is total (complete authentication bypass). The absence of public exploit code is offset by the zero barrier to exploitation. Priority: immediate patching required for any internet-facing Fastify applications using fastify/express with hierarchical plugin structures implementing authentication, authorization, or rate limiting middleware. |
| Exploit ScenarioDerived | An e-commerce API uses Fastify with fastify/express v4.0.4 to integrate legacy Express authentication middleware at the '/api' path, protecting admin endpoints at '/api/admin/*'. A developer registers an admin plugin with prefix '/api', matching the middleware path. The path doubling bug transforms the middleware path to '/api/api', causing all requests to '/api/admin/users' to bypass authentication entirely. An unauthenticated remote attacker directly requests https://victim.com/api/admin/users without credentials, receiving full access to user management functions that should require admin authentication. No exploit crafting required-the vulnerability activates through normal application configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 15, 2026
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authorization, and rate limiting controls due to path doubling logic error. When child plugins register with prefixes matching middleware paths, the onRegister function incorrectly doubles the middleware path, preventing any matches against incoming requests. Affects fastify/express versions ≤4.0.4 across all routes within child plugin scopes. Remote attackers require no authentication (CVSS PR:N), no user interaction, and low attack complexity to bypass critical security controls. No public exploit identified at time of analysis, though exploitation requires no special configuration or request crafting.
RemediationAI
Upgrade immediately to @fastify/express version 4.0.5 or later, which resolves the path doubling logic error in the onRegister function. Use npm (npm update @fastify/express) or yarn (yarn upgrade @fastify/express) to apply the patch. Verify the installed version post-upgrade using npm list @fastify/express. No configuration changes are required-version 4.0.5 automatically corrects the path handling behavior for all plugin hierarchies. If immediate patching is not feasible, implement temporary compensating controls: flatten plugin architecture to eliminate child plugins with prefixes matching middleware paths, or manually duplicate critical authentication/authorization checks within child plugin route handlers. However, these workarounds are error-prone and should only be used as short-term mitigations. The vendor-released patch (version 4.0.5) is the only complete remediation. Reference the GitHub security advisory at https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c for additional context and the OpenJS Foundation advisory at https://cna.openjsf.org/security-advisories.html for coordinated disclosure details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fastify Express (fastify/express) is a plugin that provides Express.js middleware compatibility within the Fastify web framework ecosystem. The vulnerability stems from CWE-436 (Interpretation Conflict) in the onRegister lifecycle hook, which manages middleware path registration during plugin composition. When Fastify's hierarchical plugin architecture registers child plugins with a prefix (e.g., '/api') that matches an existing middleware path, the flawed path normalization logic erroneously concatenates the prefix twice-transforming '/api' middleware paths into '/api/api'. This double-prefixing creates a permanent mismatch: incoming requests to '/api/*' routes never match the malformed '/api/api/*' middleware paths, causing the middleware chain to silently skip execution. The affected CPE (cpe:2.3:a:fastify:@fastify/express) identifies all versions through 4.0.4 of the npm package. Unlike typical path traversal or injection vulnerabilities, this is a pure logic error requiring no attacker input manipulation-the bug activates automatically based on legitimate plugin configuration patterns.
Know when Fastify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (openjs) · only source for this CVE.
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match incoming requests. This results in complete bypass of Express middleware security controls, including authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. No special configuration or request crafting is required.
Upgrade to @fastify/express v4.0.5 or later.
Blast Radius
ecosystem impact- 1 npm packages depend on @fastify/express (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.0.5.
Executive ViewAI
CVE-2026-33807 is a critical authentication and authorization bypass in Fastify Express plugin versions ≤4.0.4 that allows unauthenticated remote attackers to completely circumvent security controls including authentication, authorization, and rate limiting across all affected routes. Any organization using this middleware is exposed to unauthorized access to protected resources without requiring credentials or special exploits. This vulnerability requires immediate inventory and remediation given the complete loss of security control integrity.
No vendor-released patch identified at time of analysis. Interim mitigations pending patch availability: (1) Implement external authentication enforcement at reverse proxy or WAF layer (e.g., nginx/Apache with mod_auth) to re-authenticate all requests regardless of middleware state; (2) Disable or isolate affected Fastify Express plugin versions and migrate to alternative authentication middleware temporarily; (3) Restrict network access to affected services to trusted internal networks only; (4) Enable comprehensive request logging and monitoring to detect unauthorized access attempts; (5) Contact Fastify/Express maintainers to confirm patch release timeline and subscribe to security advisories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all req
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
Fastify is a fast and low overhead web framework, for Node.js. Rated high severity (CVSS 7.5), this vulnerability is rem
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: a
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger reso
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Authorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthent
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected
Fastify is a web framework with minimal overhead and plugin architecture. Rated high severity (CVSS 8.8), this vulnerabi
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Schema authorization bypass in Fastify before 5.12.2 allows an authenticated low-privilege attacker to substitute an arb
Exploit-DB