CVE-2026-112362 @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-112362?
CVE-2026-112362 is a critical vulnerability in @fastify/express, published on 27 Oct 2026.
Official description
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.
Weakness: CWE-436
Which versions are affected by CVE-2026-112362?
How do I fix CVE-2026-112362?
No fix has been published for CVE-2026-112362 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112362 being exploited?
There is no known exploitation of CVE-2026-112362 in the wild and no public exploit code.
Sources
Also known as GHSA-6h42-57hq-9746.