fastify-express vulnerabilities

Latest fastify-express CVEs

Newest publication first

1. CVE-2026-22037 @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

   Published 2026-01-19

   High·CVSS 8.4 EPSS 0.35%

   The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., /%61dmin instead of /admi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.