fastify fastify/express Schwachstellen (CVE)

Für fastify fastify/express veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.

4 Ergebnisse

9.1Kritisch

CVE-2026-6556 vor 4 Monaten

@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

@fastify/express @fastify/express

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so mi…

9.1Kritisch

CVE-2026-33807 vor 7 Monaten

@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

fastify @fastify/express

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middlew…

9.1Kritisch

CVE-2026-33808 vor 7 Monaten

@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

fastify @fastify/express

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when …

8.4Hoch

CVE-2026-22037 vor 9 Monaten

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

fastify fastify-express

The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%6…