Executive brief
@fastify/express is a library used to run Express.js middleware within the Fastify web framework. A flaw in how the library handles URL paths causes security protections—such as login requirements, permission checks, and rate limits—to be accidentally disabled for certain parts of an application. This could allow unauthorized users to access sensitive data or administrative functions without any special technical tricks or hacking tools.
Technical details
A vulnerability exists in the onRegister function of @fastify/express (v4.0.4 and earlier) due to improper path prefixing. When a child plugin is registered with a prefix that matches an existing middleware path, the library incorrectly prepends the prefix a second time (e.g., changing '/admin' to '/admin/admin'). Because the resulting path no longer matches incoming requests, any Express middleware—including those for authentication, authorization, and rate limiting—is silently skipped for all routes within that child plugin's scope. This occurs in default configurations and requires no special request crafting to exploit. The issue is resolved in version 4.0.5.
Affected products
- Fastify @fastify/express <= 4.0.4
Timeline
- 2026-04-15: disclosed
- 2026-04-15: advisory
- 2026-04-15: patched: Fixed in version 4.0.5