Fastify Express CVE-2026-33808

Immediately upgrade to @fastify/express version 4.0.5 or later, which resolves the URL normalization mismatch by ensuring Express middleware receives the same normalized URL that Fastify's router processes. For applications using npm, execute 'npm install @fastify/express@latest' or update package.json to specify '@fastify/express': '^4.0.5' and run 'npm install'. If immediate patching is not feasible, implement temporary mitigations: disable ignoreDuplicateSlashes and useSemicolonDelimiter options in Fastify router configuration to eliminate the normalization discrepancy, or migrate authentication logic from Express middleware to Fastify-native onRequest hooks which operate on normalized URLs consistently. Verify patch effectiveness by testing authentication bypass scenarios with duplicate slashes and semicolons in protected route paths. Review application logs for suspicious URL patterns containing '//' or ';' in requests to protected endpoints that may indicate exploitation attempts prior to patching. Consult the official security advisory at https://github.com/fastify/fastify-express/security/advisories/GHSA-6hw5-45gm-fj88 for additional implementation guidance and verification procedures.