{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@fastify/express-4.0.5-4.0.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fastify:fastify-express:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-112362"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@fastify/express (4.0.5-4.0.8)"],"_cs_severities":["critical"],"_cs_tags":["web-application","bypass","authentication"],"_cs_type":"advisory","_cs_vendors":["Fastify"],"content_html":"\u003cp\u003eThe @fastify/express plugin, which allows Express middleware to run within a Fastify application, is vulnerable to a bypass of security controls when the non-default \u003ccode\u003eignoreDuplicateSlashes\u003c/code\u003e configuration is enabled. In versions 4.0.5 through 4.0.8, Fastify's router normalizes the path of an absolute-form request target by collapsing duplicate slashes, including those following the URL scheme. This mismatch causes the Fastify router to route requests to restricted paths while the Express middleware layer fails to recognize the path, effectively skipping authentication, authorization, or rate-limiting logic.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn unauthenticated attacker can reach handlers on protected or scoped routes by crafting absolute-form request targets that trigger the path normalization mismatch, bypassing security middleware.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@fastify/express\u003c/code\u003e to version 4.0.9 or later.\u003c/li\u003e\n\u003cli\u003eAs an immediate workaround, disable the \u003ccode\u003eignoreDuplicateSlashes\u003c/code\u003e configuration option if it is currently enabled.\u003c/li\u003e\n\u003cli\u003eImplement authentication/authorization logic within a Fastify \u003ccode\u003epreHandler\u003c/code\u003e hook, as these hooks are executed after the router resolves the request and are not bypassed by this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T13:49:57Z","date_published":"2026-10-27T13:49:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fastify-express-bypass/","summary":"An authentication and authorization bypass vulnerability in @fastify/express versions 4.0.5 through 4.0.8 occurs when the non-default ignoreDuplicateSlashes option is enabled, allowing attackers to access restricted handlers by misaligning path normalization between Fastify and Express middleware.","title":"@fastify/express: Authentication bypass via path normalization (CVE-2026-112362)","url":"https://feed.craftedsignal.io/briefs/2026-10-fastify-express-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - @Fastify/Express (4.0.5-4.0.8)","version":"https://jsonfeed.org/version/1.1"}