EUVD-2026-22881
GHSA-6hw5-45gm-fj88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend request with duplicate slashes or semicolons
-
DeliveryFastify normalizes URL internally
-
Exploit@fastify/express passes original URL to Express
-
ExecutionAuthentication middleware fails to match
-
ImpactAccess protected resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
| Exploitation Conditions | Exploitation requires the target Fastify application to have explicitly enabled EITHER the ignoreDuplicateSlashes option (configured in Fastify router options as 'ignoreDuplicateSlashes: true') OR the useSemicolonDelimiter option (configured as 'useSemicolonDelimiter: true'), AND the application must use Express-compatible middleware via @fastify/express for path-scoped authentication or authorization (rather than Fastify-native onRequest/preHandler hooks). Vulnerable configurations are typically found in applications migrating from Express to Fastify |
| Impact | This vulnerability presents critical real-world risk despite no confirmed active exploitation. The CVSS v4.0 score of 9.1 (Critical) accurately reflects the severity: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with high confidentiality and integrity impact (VC:H/VI:H). The 'AT:P' (Attack Requirements: Present) modifier indicates specific deployment conditions must exist (Fastify normalization options enabled), which moderately reduces the attack surface but does not eliminate risk. While EPSS probability data is unavailable and no KEV listing exists, the vulnerability's simplicity-requiring only URL path manipulation via HTTP requests-makes it highly automatable and trivial to exploit where conditions are met. The technical barrier is minimal: attackers need only append duplicate slashes or semicolons to protected URLs. The primary risk mitigator is that exploitation requires the Fastify application to have explicitly enabled ignoreDuplicateSlashes or useSemicolonDelimiter options AND to rely on Express middleware for authentication rather than Fastify-native hooks. Organizations using @fastify/express v4.0.4 or earlier with these normalization features enabled for path-based authentication should treat this as an emergency patch priority, as complete authentication bypass enables unauthorized access to sensitive application functionality and data. |
| Exploit ScenarioDerived | An attacker identifies a Fastify application using @fastify/express with authentication middleware protecting '/api/admin' endpoints. The application has enabled ignoreDuplicateSlashes for URL flexibility. The attacker sends a crafted HTTP GET request to '/api//admin/users' (note duplicate slashes). Fastify's router normalizes the path to '/api/admin/users' and matches the route, but @fastify/express passes the original '/api//admin/users' to the Express authentication middleware configured for '/api/admin/*'. The middleware fails to match the malformed path pattern and skips execution, allowing the unauthenticated request to proceed directly to the protected admin handler, exposing sensitive user data or enabling unauthorized administrative actions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 15, 2026
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected routes via URL path manipulation. The vulnerability exploits a URL normalization mismatch: Fastify router normalizes URLs (removing duplicate slashes or handling semicolon delimiters based on configuration), but @fastify/express passes the original un-normalized URL to Express middleware, causing path-scoped authentication checks to fail and be skipped entirely. No public expl
Earlier versions of this analysis (1)
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected routes via URL path manipulation. The vulnerability exploits a URL normalization mismatch: Fastify router normalizes URLs (removing duplicate slashes or handling semicolon delimiters based on configuration), but @fastify/express passes the original un-normalized URL to Express middleware, causing path-scoped authentication checks to fail and be skipped entirely. No public exploit code identified at time of analysis, though exploitation is straightforward with low attack complexity (CVSS AC:L). EPSS data not available, not listed in CISA KEV.
RemediationAI
Immediately upgrade to @fastify/express version 4.0.5 or later, which resolves the URL normalization mismatch by ensuring Express middleware receives the same normalized URL that Fastify's router processes. For applications using npm, execute 'npm install @fastify/express@latest' or update package.json to specify '@fastify/express': '^4.0.5' and run 'npm install'. If immediate patching is not feasible, implement temporary mitigations: disable ignoreDuplicateSlashes and useSemicolonDelimiter options in Fastify router configuration to eliminate the normalization discrepancy, or migrate authentication logic from Express middleware to Fastify-native onRequest hooks which operate on normalized URLs consistently. Verify patch effectiveness by testing authentication bypass scenarios with duplicate slashes and semicolons in protected route paths. Review application logs for suspicious URL patterns containing '//' or ';' in requests to protected endpoints that may indicate exploitation attempts prior to patching. Consult the official security advisory at https://github.com/fastify/fastify-express/security/advisories/GHSA-6hw5-45gm-fj88 for additional implementation guidance and verification procedures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
@fastify/express is a middleware adapter that enables the use of Express-compatible middleware within Fastify applications. Fastify's router supports normalization options including ignoreDuplicateSlashes (treating '/api//protected' as '/api/protected') and useSemicolonDelimiter (treating '/api;protected' as '/api/protected'). The vulnerability (CWE-436: Interpretation Conflict) arises from a classic normalization mismatch between routing layers: Fastify's router performs normalization and successfully matches routes, but the @fastify/express adapter passes the raw, pre-normalization URL to Express middleware functions. Express middleware configured to protect specific paths (e.g., '/api/protected') receives the malformed path ('/api//protected' or '/api;protected') and fails to match, causing the middleware to skip execution entirely. This is a critical architectural flaw in multi-layer web frameworks where different components make inconsistent assumptions about URL canonicalization, a common source of security boundary violations in proxy and middleware chain scenarios.
Know when Fastify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (openjs) · only source for this CVE.
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or via semicolon delimiters when useSemicolonDelimiter is enabled. In both cases, Fastify router normalizes the URL and matches the route, but @fastify/express passes the original un-normalized URL to Express middleware, which fails to match and is skipped. An unauthenticated attacker can access protected routes by manipulating the URL path.
PatchesUpgrade to @fastify/express v4.0.5 or later.
Blast Radius
ecosystem impact- 1 npm packages depend on @fastify/express (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.0.5.
Executive ViewAI
@fastify/express versions 4.0.4 and earlier contain a critical authentication bypass that allows unauthenticated remote attackers to access protected application routes through URL path manipulation. This vulnerability affects any organization using Fastify with the Express adapter for middleware-based authentication, potentially exposing sensitive data and functionality without requiring valid credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement strict URL normalization validation at application entry point before routing; (2) enforce re-authentication for all protected routes using additional middleware verification independent of path-matching logic; (3) deploy WAF rules to block requests with suspicious URL encoding (double slashes, semicolon delimiters); (4) restrict network access to protected endpoints to known trusted IPs pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all req
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
Fastify is a fast and low overhead web framework, for Node.js. Rated high severity (CVSS 7.5), this vulnerability is rem
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: a
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger reso
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Authorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthent
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authoriza
Fastify is a web framework with minimal overhead and plugin architecture. Rated high severity (CVSS 8.8), this vulnerabi
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Schema authorization bypass in Fastify before 5.12.2 allows an authenticated low-privilege attacker to substitute an arb
Exploit-DB