---
id: CVE-2026-112362
title: >-
  @fastify/express vulnerable to path-scoped middleware bypass via absolute-form
  request targets
summary: >-
  @fastify/express is a Fastify plugin that runs Express middleware inside
  Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the
  non-default ignoreDuplicateSlashes option enabled, the plugin matches
  path-scoped Express middl…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-436
vendor: '@fastify/express'
product: '@fastify/express'
affected:
  - '@fastify/express >= 4.0.5 < 4.0.9'
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T11:27:59.364Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112362'
references:
  - url: >-
      https://github.com/fastify/fastify-express/security/advisories/GHSA-6h42-57hq-9746
  - url: 'https://cna.openjsf.org/security-advisories.html'
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.306Z'
---

## Overview

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.

## Affected

- `@fastify/express >= 4.0.5 < 4.0.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.