Is CVE-2026-33807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33807 being exploited in the wild.

How severe is CVE-2026-33807?

Critical severity, with a CVSS score of 9.1, published 15 April 2026.

Which products and versions are affected?

Fastify Express <= 4.0.4; @fastify/express (npm) <= 4.0.4, SEMVER:introduced=0,fixed=4.0.5.

Is there a fix for CVE-2026-33807?

Yes. @fastify/express (npm): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33807 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33807?

Check whether you run Fastify Express or @fastify/express (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33807: Fastify @fastify/express middleware bypass in child plugin scopes

Q: Which products and versions are affected?

Fastify Express <= 4.0.4; @fastify/express (npm) <= 4.0.4, SEMVER:introduced=0,fixed=4.0.5.

Q: Is there a fix for CVE-2026-33807?

Yes. @fastify/express (npm): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33807 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33807?

Check whether you run Fastify Express or @fastify/express (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33807 · Severity: critical · CVSS 9.1 · Published 2026-04-15

@fastify/express is a library used to run Express.js middleware within the Fastify web framework. A flaw in how the library handles URL paths causes security protections—such as login requirements, permission checks, and rate limits—to be accidentally disabled for certain parts of an application. This could allow unauthorized users to access sensitive data or administrative functions without any special technical tricks or hacking tools.

Technologies: Fastify Express, @fastify/express (npm). Vendors: Fastify, npm.

Quick answers

Is CVE-2026-33807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33807 being exploited in the wild.
How severe is CVE-2026-33807?: Critical severity, with a CVSS score of 9.1, published 15 April 2026.
Which products and versions are affected?: Fastify Express <= 4.0.4; @fastify/express (npm) <= 4.0.4, SEMVER:introduced=0,fixed=4.0.5.
Is there a fix for CVE-2026-33807?: Yes. @fastify/express (npm): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33807 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33807?: Check whether you run Fastify Express or @fastify/express (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@fastify/express (npm): upgrade to 4.0.5 or later
```
npm install @fastify/express@4.0.5
```

Technical details

A vulnerability exists in the onRegister function of @fastify/express (v4.0.4 and earlier) due to improper path prefixing. When a child plugin is registered with a prefix that matches an existing middleware path, the library incorrectly prepends the prefix a second time (e.g., changing '/admin' to '/admin/admin'). Because the resulting path no longer matches incoming requests, any Express middleware—including those for authentication, authorization, and rate limiting—is silently skipped for all routes within that child plugin's scope. This occurs in default configurations and requires no special request crafting to exploit. The issue is resolved in version 4.0.5.

Affected products

Fastify @fastify/express <= 4.0.4

Identifiers

CVE-2026-33807
GHSA-hrwm-hgmj-7p9c

Timeline

2026-04-15: disclosed
2026-04-15: advisory
2026-04-15: patched: Fixed in version 4.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.