Cpe:2.3:a:fastify:fastify-Express:*:*:*:*:*:node.js:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afastifyfastify-expressnode.js/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 13:49:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svg@fastify/express: Authentication bypass via path normalization (CVE-2026-112362)https://feed.craftedsignal.io/briefs/2026-10-fastify-express-bypass/Tue, 27 Oct 2026 13:49:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-fastify-express-bypass/An authentication and authorization bypass vulnerability in @fastify/express versions 4.0.5 through 4.0.8 occurs when the non-default ignoreDuplicateSlashes option is enabled, allowing attackers to access restricted handlers by misaligning path normalization between Fastify and Express middleware.The @fastify/express plugin, which allows Express middleware to run within a Fastify application, is vulnerable to a bypass of security controls when the non-default ignoreDuplicateSlashes configuration is enabled. In versions 4.0.5 through 4.0.8, Fastify's router normalizes the path of an absolute-form request target by collapsing duplicate slashes, including those following the URL scheme. This mismatch causes the Fastify router to route requests to restricted paths while the Express middleware layer fails to recognize the path, effectively skipping authentication, authorization, or rate-limiting logic.

Impact

An unauthenticated attacker can reach handlers on protected or scoped routes by crafting absolute-form request targets that trigger the path normalization mismatch, bypassing security middleware.

Recommendation

  • Upgrade @fastify/express to version 4.0.9 or later.
  • As an immediate workaround, disable the ignoreDuplicateSlashes configuration option if it is currently enabled.
  • Implement authentication/authorization logic within a Fastify preHandler hook, as these hooks are executed after the router resolves the request and are not bypassed by this vulnerability.
]]>criticaladvisoryweb-applicationbypassauthentication