@fastify/express: Path-scoped middleware bypass via absolute-form request targets
Summary
The @fastify/express plugin, which runs Express middleware inside Fastify, is affected in versions 4.0.5 to 4.0.8 when Fastify runs with the non-default ignoreDuplicateSlashes option enabled. An unauthenticated remote attacker can send a request with an absolute-form request target, such as a full URL, to reach a handler on a scoped route like an admin path while authentication, authorization or rate-limiting middleware is skipped. No credentials are required, but the non-default option must be enabled for the flaw to apply.
Affected
- @fastify/express 4.0.5 to 4.0.8 (vendor range >= 4.0.5, < 4.0.9)
- Only when Fastify runs with ignoreDuplicateSlashes enabled (non-default)
Fixed in
- Upgrade to @fastify/express 4.0.9 or later.
Workaround
- Enforce authentication in a Fastify hook such as preHandler that runs after the router has resolved the request.
- Set ignoreDuplicateSlashes to its default (off).
Exploitation
- Unknown. No known exploitation at the time of research (not listed as known exploited by OffSeq; KEV status not verified directly).
- No public proof of concept found (unverified).
Our recommendation
- Inventory Node.js applications for @fastify/express versions 4.0.5 to 4.0.8 (check lockfiles and deployed images).
- Upgrade to 4.0.9 or later.
- Check whether ignoreDuplicateSlashes is set, either top-level or in routerOptions. If it is and you cannot upgrade immediately, apply the authentication-hook workaround.
- Review access logs for absolute-form request targets hitting admin paths.
- Internet-facing apps that use Express middleware for admin access control are the highest risk.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA Security Advisories cna.openjsf.org
- GitHub Security Advisory GHSA-6h42-57hq-9746 github.com
- @fastify/express release v4.0.9 github.com
- Strix CVE-2026-112362 www.strix.ai
- OSV CVE-2026-112362 (Vulners) vulners.com
- OffSeq Radar CVE-2026-112362 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:24.
Original description (NVD)
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.