@fastify/express güvenlik açıkları (CVE)

@fastify/express için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

2 sonuç

9.1Kritik

CVE-2026-112362 19 gün önce

@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

@fastify/express @fastify/express

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL wh…

9.1Kritik

CVE-2026-6556 4 ay önce

@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

@fastify/express @fastify/express

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so mi…