Skip to content
Threat Feed
Subscribe

Tag

Url-Normalization

1 brief RSS
critical advisory

@fastify/express Authentication Bypass via URL Normalization Gaps

A vulnerability exists in `@fastify/express` v4.0.4 that allows complete bypass of path-scoped authentication middleware via URL normalization gaps, specifically through duplicate slashes and semicolon delimiters, leading to unauthorized access to protected routes.

@fastify/express fastify express authentication-bypass url-normalization cve-2026-33808
2r 1t 1c