CVE-2026-22037

The record

The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. The vulnerability is caused by how @fastify/express matches requests against registered middleware paths. This vulnerability is similar to, but differs from, CVE-2026-22031 because this is a different npm module with its own code. Version 4.0.3 of @fastify/express contains a patch fort the issue.

Affected packages

Related vulnerabilities

• GHSA-g6q3-96cp-5r5m @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) Same vulnerability
• GHSA-6hw5-45gm-fj88 @fastify/express has a middleware authentication bypass via URL normalization gaps… Also affects @fastify/express
• GHSA-hrwm-hgmj-7p9c @fastify/express's middleware path doubling causes authentication bypass in child plugin… Also affects @fastify/express
• CVE-2026-33807 @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister… Also affects @fastify/express
• CVE-2026-33808 Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to… Also affects @fastify/express
• CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host… CWE-177
• CVE-2026-76172 fast-uri is a URI parser for Node.js. CWE-177
• CVE-2026-41041 URL path injection via unencoded user-supplied identifiers vulnerability in Apache… CWE-177