EUVD-2026-40309Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network and unauthenticated (AV:N/PR:N), but AC:H because exploitation depends on the app using array/RegExp mount paths for security middleware in a prefixed scope; high C/I from bypassed authz, no availability impact.
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb
Lifecycle Timeline
2DescriptionCVE.org
@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authentication, authorization, rate limiting, or auditing on routes inside a prefixed scope can be bypassed by sending a request to the prefixed route, because Fastify still matches the route but the middleware is skipped. Patches: upgrade to @fastify/express 4.0.7. Workarounds: use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path.
AnalysisAI
Authorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthenticated remote attackers reach protected routes inside prefixed Fastify plugin scopes when security middleware is mounted using array or regular-expression paths. Because those non-string mount paths are never rewritten with the plugin prefix, authentication, authorization, rate-limiting, or auditing middleware silently fails to match the real request path and is skipped while Fastify still routes the request to the handler. There is no public exploit identified at time of analysis, and the issue is fixed in 4.0.7.
Technical ContextAI
@fastify/express is the official Fastify plugin that runs Express-style middleware (app.use) inside Fastify, commonly used by teams migrating from Express or reusing Express ecosystem middleware. Fastify supports encapsulated plugin 'scopes' that can be registered under a path prefix; the plugin is responsible for rewriting middleware mount paths to include that prefix so middleware applies to the prefixed routes. The flaw is a CWE-285 Improper Authorization issue rooted in incomplete input handling: the prefix-rewrite logic only fires when the mount path argument is a string. When developers pass an array of paths or a RegExp (both valid Express mount-path forms), the prefix is not prepended, so the middleware's match pattern no longer corresponds to the actual prefixed URL Fastify dispatches, creating a gap between routing and policy enforcement.
RemediationAI
Vendor-released patch: 4.0.7 - upgrade @fastify/express to 4.0.7 or later, which restores prefix rewriting for non-string mount paths, per GHSA-3wf5-7852-vcfq (https://github.com/fastify/fastify-express/security/advisories/GHSA-3wf5-7852-vcfq). If an immediate upgrade is not possible, the vendor-documented workarounds are to convert every middleware mount path inside a prefixed plugin from an array or regular expression into a plain string path, or to register a separate individual use() call per path so each is a string; the trade-off is more verbose registration code and the need to audit every prefixed scope for array/RegExp usage, since any missed instance leaves the bypass open. As an interim compensating control, place the affected authentication/authorization checks at a layer that does not depend on the plugin's path rewriting (for example enforce them in the route handler or via Fastify hooks) until the upgrade is applied.
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all req
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
Fastify is a fast and low overhead web framework, for Node.js. Rated high severity (CVSS 7.5), this vulnerability is rem
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: a
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger reso
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authoriza
Fastify is a web framework with minimal overhead and plugin architecture. Rated high severity (CVSS 8.8), this vulnerabi
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Schema authorization bypass in Fastify before 5.12.2 allows an authenticated low-privilege attacker to substitute an arb
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today