Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-33808— @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

Quick assessment

Affected
fastify @fastify/express
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

@fastify/express是Fastify开源的一个兼容性插件。 @fastify/express 4.0.4及之前版本存在安全漏洞，该漏洞源于在启用Fastify路由器规范化选项时，未在将URL传递给Express中间件之前对其进行规范化，可能导致通过重复斜杠或分号分隔符绕过路径范围的身份验证中间件。

AI Predicted 9.8 Difficulty: Easy EPSS 0.55% · P44
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-33808

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Source: CVE Program / CVE List V5
Vulnerability Description
Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or via semicolon delimiters when useSemicolonDelimiter is enabled. In both cases, Fastify router normalizes the URL and matches the route, but @fastify/express passes the original un-normalized URL to Express middleware, which fails to match and is skipped. An unauthenticated attacker can access protected routes by manipulating the URL path. PatchesUpgrade to @fastify/express v4.0.5 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
解释冲突
Source: CVE Program / CVE List V5
Vulnerability Title
@fastify/express 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
@fastify/express是Fastify开源的一个兼容性插件。 @fastify/express 4.0.4及之前版本存在安全漏洞，该漏洞源于在启用Fastify路由器规范化选项时，未在将URL传递给Express中间件之前对其进行规范化，可能导致通过重复斜杠或分号分隔符绕过路径范围的身份验证中间件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
fastify @fastify/express 0 ~ 4.0.5 -

II. Public POCs for CVE-2026-33808

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-33808

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-33808 (1)

Same Patch Batch · fastify · 2026-04-15 · 3 CVEs total

CVE-2026-33807 9.1 CRITICAL @fastify/express vulnerable to middleware path doubling causing authentication bypass in c
CVE-2026-33806 7.5 HIGH fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Head

IV. Related Vulnerabilities

Same product: @fastify/express
Same vendor: fastify
Same weakness: CWE-436

V. Comments for CVE-2026-33808

No comments yet

Leave a comment