GHSA-g6q3-96cp-5r5m
High · 8.4CVSS
8.4
EPSS
—
Published
Jan 20, 2026
CISA due date
—
The record
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fastify/express | 0 | 4.0.3 |
Related vulnerabilities
- CVE-2026-22037 The @fastify/express plugin adds full Express compatibility to Fastify. Same vulnerability
- GHSA-6hw5-45gm-fj88 @fastify/express has a middleware authentication bypass via URL normalization gaps… Also affects @fastify/express
- GHSA-hrwm-hgmj-7p9c @fastify/express's middleware path doubling causes authentication bypass in child plugin… Also affects @fastify/express
- CVE-2026-33807 @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister… Also affects @fastify/express
- CVE-2026-33808 Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to… Also affects @fastify/express
- CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host… CWE-177
- CVE-2026-76172 fast-uri is a URI parser for Node.js. CWE-177
- CVE-2026-41041 URL path injection via unencoded user-supplied identifiers vulnerability in Apache… CWE-177