Executive brief
@fastify/express is a library used to integrate Express middleware into Fastify web applications. A flaw in how it handles certain path types allows security middleware—such as those for authentication or rate limiting—to be bypassed. This could allow unauthorized users to access protected data or administrative functions by sending requests that skip the intended security checks.
Technical details
The vulnerability is an improper authorization check (CWE-285) caused by a failure to rewrite plugin prefixes for non-string mount paths. In @fastify/express versions 4.0.6 and earlier, when middleware is registered using an array of paths or a Regular Expression within a prefixed plugin scope, the prefix is not applied to these paths. Consequently, Express fails to match the unprefixed pattern against the actual incoming request path, causing the middleware to be skipped. If this middleware is responsible for authentication, authorization, or auditing, an attacker can bypass these controls to reach the underlying route. The issue is resolved in version 4.0.7.
Affected products
- Fastify @fastify/express <= 4.0.6
Timeline
- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date
- 2026-06-30: patched: Version 4.0.7 released