@fastify/express: Authentication bypass via path normalization (CVE-2026-112362)

The @fastify/express plugin, which allows Express middleware to run within a Fastify application, is vulnerable to a bypass of security controls when the non-default ignoreDuplicateSlashes configuration is enabled. In versions 4.0.5 through 4.0.8, Fastify's router normalizes the path of an absolute-form request target by collapsing duplicate slashes, including those following the URL scheme. This mismatch causes the Fastify router to route requests to restricted paths while the Express middleware layer fails to recognize the path, effectively skipping authentication, authorization, or rate-limiting logic.

Impact

An unauthenticated attacker can reach handlers on protected or scoped routes by crafting absolute-form request targets that trigger the path normalization mismatch, bypassing security middleware.

Recommendation

• Upgrade @fastify/express to version 4.0.9 or later.
• As an immediate workaround, disable the ignoreDuplicateSlashes configuration option if it is currently enabled.
• Implement authentication/authorization logic within a Fastify preHandler hook, as these hooks are executed after the router resolves the request and are not bypassed by this vulnerability.