CVE-2026-33808: Fastify @fastify/express auth bypass via URL normalization gaps

Executive brief

A vulnerability in the @fastify/express library allows attackers to bypass security rules that protect sensitive parts of a website. By using specially crafted web addresses with extra slashes or semicolons, an attacker can trick the system into skipping authentication checks. This could lead to unauthorized access to administrative panels, private user data, or restricted internal APIs.

Technical details

A URL normalization discrepancy exists between the Fastify router and the @fastify/express middleware wrapper. When 'ignoreDuplicateSlashes' or 'useSemicolonDelimiter' is enabled in Fastify, the router correctly matches normalized paths (e.g., '//admin' to '/admin'), but the 'enhanceRequest' function passes the un-normalized URL to Express middleware. Because Express middleware uses strict prefix matching via path-to-regexp, characters like duplicate slashes or semicolons cause the middleware to fail its match and be skipped, while the Fastify route handler still executes. This allows unauthenticated access to routes intended to be protected by Express-based auth middleware. The issue is patched in version 4.0.5.

Affected products

• fastify @fastify/express <= 4.0.4

Timeline

• 2026-04-15: advisory: GitHub Advisory published
• 2026-04-16: disclosed: CVE-2026-33808 assigned
• 2026-04-15: patched: Fixed in version 4.0.5

References

• https://api.github.com/users/FredKSchott
• https://github.com/FredKSchott
• https://api.github.com/users/FredKSchott/gists%7B/gist_id%7D
• https://api.github.com/users/FredKSchott/repos
• https://avatars.githubusercontent.com/u/622227?v=4
• https://api.github.com/users/FredKSchott/events%7B/privacy%7D