CVE-2026-112362

Name of the Vulnerable Software and Affected Versions @fastify/express versions 4.0.5 through 4.0.8

Description When the non-default ignoreDuplicateSlashes option is enabled, the plugin matches path-scoped Express middleware against a URL where duplicate-slash normalization collapses the separator after an absolute-form request target's scheme. This causes the Fastify router to resolve the request to the scoped path and execute the handler, while the Express layer fails to recognize the path. Consequently, an unauthenticated attacker can use an absolute-form target to access handlers on scoped routes, such as admin paths, bypassing middleware intended for authentication, authorization, or rate limiting.

Recommendations Update to version 4.0.9 or later. Enforce authentication in a Fastify hook such as preHandler that executes after the router resolves the request. Keep the ignoreDuplicateSlashes option at its default setting.