Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112362— @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

Quick assessment

Affected
@fastify/express @fastify/express
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个 Fastify 插件，用于在 Fastify 中运行 Express 中间件。在版本 4.0.5 至 4.0.8 中，当 Fastify 启用了非默认的 选项时，该插件会将路径作用域的 Express 中间件与一个 URL 进行匹配，而该 URL 的重复斜杠归一化过程已同时合并了绝对形式请求目标中方案（scheme）之后的分隔符。这导致 Fastify 的路由器将请求解析为作用域路径并执行处理器，但 Express 层却不再看到该路径。因此，使用绝对形式目标的请求可以绕过身份验证、授权或速率限制等中间件，直

CVSS 9.1 · Critical EPSS 0.36% · P30

Affected Version Matrix 2

VendorProduct Version RangeStatus
@fastify/express @fastify/express 4.0.5< 4.0.9 affected
4.0.9 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112362

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
解释冲突
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/express @fastify/express 4.0.5 ~ 4.0.9 -

II. Public POCs for CVE-2026-112362

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112362

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-112362 (1)

IV. Related Vulnerabilities

Same product: @fastify/express
Same vendor: @fastify/express
Same weakness: CWE-436