# CVE-2026-33808: Fastify @fastify/express auth bypass via URL normalization gaps

Source: https://junglewise.ai/threats/cve-2026-33808-fastify-fastify-express-auth-bypass-via-url-normalization-gaps  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-15. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-33808 · Severity: critical · CVSS 9.1 · Published 2026-04-15

A vulnerability in the @fastify/express library allows attackers to bypass security rules that protect sensitive parts of a website. By using specially crafted web addresses with extra slashes or semicolons, an attacker can trick the system into skipping authentication checks. This could lead to unauthorized access to administrative panels, private user data, or restricted internal APIs.

Technologies: [Fastify Express](https://junglewise.ai/threats/technologies/express), [@fastify/express (npm)](https://junglewise.ai/threats/technologies/fastify-express). Vendors: [Fastify](https://junglewise.ai/threats/vendors/fastify), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-33808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33808 being exploited in the wild.

**How severe is CVE-2026-33808?** Critical severity, with a CVSS score of 9.1, published 15 April 2026.

**Which products and versions are affected?** Fastify Express <= 4.0.4; @fastify/express (npm) <= 4.0.4, SEMVER:introduced=0,fixed=4.0.5.

**Is there a fix for CVE-2026-33808?** Yes. @fastify/express (npm): upgrade to 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33808 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33808?** Check whether you run Fastify Express or @fastify/express (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @fastify/express (npm): upgrade to 4.0.5 or later

  ```sh
  npm install @fastify/express@4.0.5
  ```


## Technical details

A URL normalization discrepancy exists between the Fastify router and the @fastify/express middleware wrapper. When 'ignoreDuplicateSlashes' or 'useSemicolonDelimiter' is enabled in Fastify, the router correctly matches normalized paths (e.g., '//admin' to '/admin'), but the 'enhanceRequest' function passes the un-normalized URL to Express middleware. Because Express middleware uses strict prefix matching via path-to-regexp, characters like duplicate slashes or semicolons cause the middleware to fail its match and be skipped, while the Fastify route handler still executes. This allows unauthenticated access to routes intended to be protected by Express-based auth middleware. The issue is patched in version 4.0.5.

## Affected products

- fastify @fastify/express <= 4.0.4

## Identifiers

- CVE-2026-33808
- GHSA-6hw5-45gm-fj88

## Timeline

- 2026-04-15: advisory: GitHub Advisory published
- 2026-04-16: disclosed: CVE-2026-33808 assigned
- 2026-04-15: patched: Fixed in version 4.0.5

## References

- [https://api.github.com/users/FredKSchott](https://api.github.com/users/FredKSchott)
- [https://github.com/FredKSchott](https://github.com/FredKSchott)
- [https://api.github.com/users/FredKSchott/gists%7B/gist_id%7D](https://api.github.com/users/FredKSchott/gists%7B/gist_id%7D)
- [https://api.github.com/users/FredKSchott/repos](https://api.github.com/users/FredKSchott/repos)
- [https://avatars.githubusercontent.com/u/622227?v=4](https://avatars.githubusercontent.com/u/622227?v=4)
- [https://api.github.com/users/FredKSchott/events%7B/privacy%7D](https://api.github.com/users/FredKSchott/events%7B/privacy%7D)

## Related threats

- [Fastify @fastify/express middleware bypass via non-string mount paths](https://junglewise.ai/threats/cve-2026-6556-fastify-fastify-express-middleware-bypass-via-non-string-mount)
- [Fastify @fastify/express middleware bypass in child plugin scopes](https://junglewise.ai/threats/cve-2026-33807-fastify-fastify-express-middleware-bypass-in-child-plugin-scopes)
- [Fastify @fastify/express middleware bypass via URL encoding](https://junglewise.ai/threats/cve-2026-22037-fastify-fastify-express-middleware-bypass-via-url-encoding)