CVE-2026-33808

The record

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or via semicolon delimiters when useSemicolonDelimiter is enabled. In both cases, Fastify router normalizes the URL and matches the route, but @fastify/express passes the original un-normalized URL to Express middleware, which fails to match and is skipped. An unauthenticated attacker can access protected routes by manipulating the URL path. PatchesUpgrade to @fastify/express v4.0.5 or later.

Affected packages

Related vulnerabilities

• GHSA-6hw5-45gm-fj88 @fastify/express has a middleware authentication bypass via URL normalization gaps… Same vulnerability
• GHSA-hrwm-hgmj-7p9c @fastify/express's middleware path doubling causes authentication bypass in child plugin… Also affects @fastify/express
• CVE-2026-33807 @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister… Also affects @fastify/express
• GHSA-g6q3-96cp-5r5m @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) Also affects @fastify/express
• CVE-2026-22037 The @fastify/express plugin adds full Express compatibility to Fastify. Also affects @fastify/express
• CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that… CWE-436
• CVE-2026-93750 http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the… CWE-436
• CVE-2026-82537 Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows… CWE-436