CVE-2026-33807 - Vulnerability Analysis

Overview

@fastify/express <= 4.0.4 contains a path handling bug in onRegister function causing middleware paths to be doubled in child plugins, letting attackers bypass middleware security controls, exploit requires no special conditions.

Severity & Score

Impact

Attackers can bypass authentication, authorization, and rate limiting, compromising security of all routes in affected child plugins.

Mitigation

Upgrade to @fastify/express v4.0.5 or later.

References

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner