CVE-2026-6556

Name of the Vulnerable Software and Affected Versions @fastify/express versions prior to 4.0.7

Description A middleware scoping flaw exists where plugin prefixes are not applied to middleware mount paths when the mount path is provided as an array or a regular expression. This occurs due to improper input handling during prefix and path normalization, causing middleware to be registered without the prefix inside prefixed plugin scopes. An attacker can bypass security controls such as authentication, authorization, rate limiting, or auditing by sending requests to routes under a prefixed plugin where the middleware was mounted using non-string paths. Fastify continues to match the route, but the associated middleware is skipped.

Recommendations Upgrade to @fastify/express version 4.0.7. As a temporary workaround, use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path.