GHSA-6hw5-45gm-fj88
Critical · 9.1CVSS
9.1
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fastify/express | 0 | 4.0.5 |
Related vulnerabilities
- CVE-2026-33808 Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to… Same vulnerability
- GHSA-hrwm-hgmj-7p9c @fastify/express's middleware path doubling causes authentication bypass in child plugin… Also affects @fastify/express
- CVE-2026-33807 @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister… Also affects @fastify/express
- GHSA-g6q3-96cp-5r5m @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) Also affects @fastify/express
- CVE-2026-22037 The @fastify/express plugin adds full Express compatibility to Fastify. Also affects @fastify/express
- CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that… CWE-436
- CVE-2026-93750 http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the… CWE-436
- CVE-2026-82537 Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows… CWE-436