CVE-2026-33808

Name of the Vulnerable Software and Affected Versions @fastify/express versions prior to 4.0.5

Description An issue exists where the software fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows an unauthenticated attacker to bypass path-scoped authentication middleware by manipulating the URL path. Specifically, the bypass occurs via duplicate slashes when ignoreDuplicateSlashes is enabled, or via semicolon delimiters when useSemicolonDelimiter is enabled. In these scenarios, the Fastify router normalizes the URL to match the route, but the original un-normalized URL is passed to Express middleware, causing it to fail to match and be skipped.

Recommendations Upgrade to @fastify/express v4.0.5 or later.