When the non-default `ignoreDuplicateSlashes` option is enabled, the plugin matches path-scoped Express middleware against a URL where duplicate-slash normalization collapses the separator after an absolute-form request target's scheme. This causes the Fastify router to resolve the request to the scoped path and execute the handler, while the Express layer fails to recognize the path. Consequently, an unauthenticated attacker can use an absolute-form target to access handlers on scoped routes, such as admin paths, bypassing middleware intended for authentication, authorization, or rate limiting.