CVE-2026-33808: Fastify @fastify/express auth bypass via URL normalization gaps

CVE-2026-33808 · Severity: critical · CVSS 9.1 · Published 2026-04-15

A vulnerability in the @fastify/express library allows attackers to bypass security rules that protect sensitive parts of a website. By using specially crafted web addresses with extra slashes or semicolons, an attacker can trick the system into skipping authentication checks. This could lead to unauthorized access to administrative panels, private user data, or restricted internal APIs.

Technologies: Fastify Express, @fastify/express (npm). Vendors: Fastify, npm.

Quick answers

Is CVE-2026-33808 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33808 being exploited in the wild.
How severe is CVE-2026-33808?
Critical severity, with a CVSS score of 9.1, published 15 April 2026.
Which products and versions are affected?
Fastify Express <= 4.0.4; @fastify/express (npm) <= 4.0.4, SEMVER:introduced=0,fixed=4.0.5.
Is there a fix for CVE-2026-33808?
Yes. @fastify/express (npm): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33808 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33808?
Check whether you run Fastify Express or @fastify/express (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @fastify/express (npm): upgrade to 4.0.5 or later
    npm install @fastify/express@4.0.5

Technical details

A URL normalization discrepancy exists between the Fastify router and the @fastify/express middleware wrapper. When 'ignoreDuplicateSlashes' or 'useSemicolonDelimiter' is enabled in Fastify, the router correctly matches normalized paths (e.g., '//admin' to '/admin'), but the 'enhanceRequest' function passes the un-normalized URL to Express middleware. Because Express middleware uses strict prefix matching via path-to-regexp, characters like duplicate slashes or semicolons cause the middleware to fail its match and be skipped, while the Fastify route handler still executes. This allows unauthenticated access to routes intended to be protected by Express-based auth middleware. The issue is patched in version 4.0.5.

Affected products

  • fastify @fastify/express <= 4.0.4

Identifiers

  • CVE-2026-33808
  • GHSA-6hw5-45gm-fj88

Timeline

  • 2026-04-15: advisory: GitHub Advisory published
  • 2026-04-16: disclosed: CVE-2026-33808 assigned
  • 2026-04-15: patched: Fixed in version 4.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.