@fastify/express vulnerabilities

Products

• @fastify/express 2

Latest @fastify/express CVEs

Newest publication first

1. CVE-2026-112362 @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

   Published 2026-10-27

   Critical·CVSS 9.1 EPSS 0.37%

   @fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash n...

2. CVE-2026-6556 @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

   Published 2026-06-30

   Critical·CVSS 9.1 EPSS 0.52%

   @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered w...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.