Advisory · CVE-2026-112362
@fastify/express path mismatch can skip Express authentication middleware on scoped routes
The @fastify/express plugin 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option, can route an absolute-form request to a scoped handler while the Express layer no longer sees that path, so path-scoped authentication, authorization, or rate-limiting middleware is skipped. CVSS 3.1 9.1.
- Vendor
- Fastify
- Product
- @fastify/express
- Identifier / CWE
- CVE-2026-112362
CWE-436 - Action timing
- Immediate
Explain it like I’m five
Two layers of the same server read the same address differently. Fastify delivers the request to a protected page, while the Express layer that was supposed to check the visitor's pass thinks the request went somewhere else, so the check never runs.
- 01Option enabled
The application runs @fastify/express 4.0.5 to 4.0.8 with Fastify's non-default ignoreDuplicateSlashes option enabled.
- 02Absolute-form request sent
An unauthenticated attacker sends a request using an absolute-form target containing duplicate slashes.
- 03Layers disagree
Slash normalization collapses the separator after the scheme for one layer, so Fastify resolves the scoped route while Express no longer matches that path.
- 04Middleware skipped
Path-scoped Express middleware for authentication, authorization, or rate limiting does not run, and the handler executes.
What happened
The OpenJS Foundation CNA published CVE-2026-112362 on October 27, 2026, rated critical at CVSS 3.1 9.1: @fastify/express, the Fastify plugin that runs Express middleware inside Fastify, matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target’s scheme, in versions 4.0.5 through 4.0.8 when Fastify runs with the non-default ignoreDuplicateSlashes option enabled. Fastify’s router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path (CWE-436).
Per the advisory, an unauthenticated attacker needs only the non-default option to be enabled, and can reach a handler on a scoped route such as an admin path while middleware for authentication, authorization, or rate limiting is skipped. The issue is fixed in @fastify/express 4.0.9. As a workaround, the advisory suggests enforcing authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leaving ignoreDuplicateSlashes at its default.
What to do
- Inventory Node.js services using @fastify/express and check both the plugin version and whether ignoreDuplicateSlashes is enabled.
- Upgrade @fastify/express to 4.0.9 or later on every affected service.
- Until upgraded, move authentication and authorization enforcement into Fastify preHandler hooks, or disable ignoreDuplicateSlashes, per the advisory’s workarounds.
- Review access logs for absolute-form request targets and duplicate-slash paths hitting admin or other scoped routes without corresponding middleware logs.
- Verify the deployed plugin version after updating, including in container images and bundled deployments.
Management note
Middleware ordering bugs are quiet: nothing crashes, the logs just show a protected route answering someone it should have turned away. Any service mixing frameworks at the edge should treat its auth path as a single chain and test it with malformed URLs, not just well-behaved ones.