# CVE-2026-112362: @fastify/express path-scoped middleware bypass via absolute-form requests

Source: https://junglewise.ai/threats/cve-2026-112362-fastify-express-is-a-fastify-plugin-that-runs-express-middleware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-112362 · Severity: critical · CVSS 9.1 · Published 2026-10-27

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify, commonly used to integrate Express-based authentication, authorization, and rate-limiting middleware into Fastify applications. When a non-default configuration option is enabled, attackers can craft requests that bypass path-scoped middleware such as authentication checks, gaining unauthorized access to protected routes like admin dashboards. This allows unauthenticated attackers to reach handlers that should be protected, potentially exposing sensitive functionality or data.

Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-112362 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112362 being exploited in the wild.

**How severe is CVE-2026-112362?** Critical severity, with a CVSS score of 9.1, published 27 October 2026.

**Which products and versions are affected?** OpenJS Foundation @Fastify/Express 4.0.5 through 4.0.8.

**Is there a fix for CVE-2026-112362?** Yes: fixed in @fastify/express 4.0.9. Until then: Enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or keep ignoreDuplicateSlashes at its default value (disabled). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112362 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-112362?** Check whether you run OpenJS Foundation @Fastify/Express at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in @fastify/express 4.0.9

Enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or keep ignoreDuplicateSlashes at its default value (disabled).

## Technical details

The vulnerability is a request routing disagreement (CWE-436) between Fastify's router and the Express middleware layer. When Fastify's ignoreDuplicateSlashes option is enabled, URL normalization collapses duplicate slashes after the scheme (http://) in absolute-form request targets, causing Fastify's router to resolve to the intended path while Express middleware scoped to that path no longer matches. An unauthenticated attacker over the network can send a crafted GET request with an absolute-form target (e.g., GET http://host/admin/dashboard) to reach scoped handlers while their authentication, authorization, and rate-limiting middleware is skipped.

## Affected products

- OpenJS Foundation @fastify/express 4.0.5 through 4.0.8

## Timeline

- 2026-10-27: disclosed

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fastify-express/security/advisories/GHSA-6h42-57hq-9746](https://github.com/fastify/fastify-express/security/advisories/GHSA-6h42-57hq-9746)