@fastify/express vulnerabilities

CVEs whose affected-version data names the @fastify/express package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-112362Critical· 9.1

4d ago

@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middl…

▾ Midnight@fastify/express · @fastify/expressvia CVEORG