{"id":"CVE-2026-112362","kind":"vulnerability","aliases":["CVE-2026-112362"],"related":[],"title":"@fastify/express: absolute-form URLs can skip Express auth middleware on scoped routes","description":"@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.","summary":"When Fastify's non-default ignoreDuplicateSlashes option is on, a request with an absolute-form target can reach a scoped route such as an admin path. Express middleware for authentication, authorization or rate limiting is skipped in that case.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["express-middleware","fastify","node","package","self-hosted"],"not_affected_if":["default-config","fixed-version"],"how_to_check":"- Run `npm ls @fastify/express` to find the installed version; 4.0.5 through 4.0.8 are affected.\n- Search the Fastify setup for `ignoreDuplicateSlashes` set to `true`.","fix":"- Upgrade `@fastify/express` to `4.0.9` or later.\n- Or leave `ignoreDuplicateSlashes` at its default.\n- Workaround from the sources: enforce authentication in a Fastify hook such as `preHandler`, which runs after the router resolves the request.","status":"open","published_at":"2026-10-27T12:17:04+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","triaged_at":"2026-10-27T12:31:58+00:00","updated_at":"2026-10-27T12:31:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T12:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `@fastify/express` to `4.0.9` or later.\n- Or leave `ignoreDuplicateSlashes` at its default.\n- Workaround from the sources: enforce authentication in a Fastify hook such as `preHandler`, which runs after the router resolves the request.","reach":"internet","title":"@fastify/express: absolute-form URLs can skip Express auth middleware on scoped routes","impact":"high","summary":"When Fastify's non-default ignoreDuplicateSlashes option is on, a request with an absolute-form target can reach a scoped route such as an admin path. Express middleware for authentication, authorization or rate limiting is skipped in that case.","category":"package","nicknames":[],"who_cares":["fastify","node","express-middleware","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated requests reach admin routes past auth middleware","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112362 and the upstream fastify/fastify-express advisory for the exact affected range and any exploit details.","how_to_check":"- Run `npm ls @fastify/express` to find the installed version; 4.0.5 through 4.0.8 are affected.\n- Search the Fastify setup for `ignoreDuplicateSlashes` set to `true`.","needs_analyst":true,"not_affected_if":["default-config","fixed-version"],"who_is_affected":"Applications that use @fastify/express versions 4.0.5 through 4.0.8 with path-scoped Express middleware protecting routes, and that have the non-default ignoreDuplicateSlashes option enabled. Apps on the default setting or on 4.0.9 or later are not affected by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000683,"input_tokens":3571,"output_tokens":652,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112362':16A,19A '-2026':15A,18A '4.0.5':83C '4.0.8':85C '4.0.9':206C,212C 'absolut':3A,44B,121C,159C 'absolute-form':2A,43B,120C,158C 'admin':55B,173C 'also':114C 'attack':188C 'auth':9A 'authent':60B,179C,219C 'author':61B,180C 'case':69B 'collaps':115C 'cve':14A,17A 'default':34B,93C,194C,240C 'duplic':110C 'duplicate-slash':109C 'enabl':96C,199C 'enforc':218C 'express':8A,21B,57B,77C,103C,144C 'express-middlewar':20B 'fastifi':23B,30B,73C,80C,87C,128C,222C 'fastify/express':1A,70C,205C 'fix':203C 'form':4A,45B,122C,160C 'handler':141C,165C 'hook':223C 'host':28B 'ignoreduplicateslash':35B,94C,195C,237C 'insid':79C 'issu':201C 'later':214C 'layer':145C 'leav':236C 'limit':64B,183C 'longer':147C 'match':99C 'middlewar':10A,22B,58B,78C,104C,177C 'need':189C 'node':24B 'non':33B,92C,193C 'non-default':32B,91C,192C 'normal':112C 'option':36B,95C,196C 'packag':25B 'path':56B,101C,137C,150C,174C 'path-scop':100C 'plugin':74C,98C 'prehandl':226C 'rate':63B,182C 'reach':48B,163C 'request':40B,123C,133C,155C,234C 'resolv':131C,232C 'result':153C 'rout':13A,51B,169C 'router':130C,231C 'run':76C,88C,139C,228C 'scheme':126C 'scope':12A,50B,102C,136C,168C 'see':148C 'self':27B 'self-host':26B 'separ':117C 'skip':7A,66B,185C 'slash':111C 'target':46B,124C,161C 'unauthent':187C 'upgrad':210C 'url':5A,107C 'use':156C 'user':208C 'version':82C 'whose':108C 'workaround':217C","nicknames":[],"mitigations":[],"who_affected":"Applications that use @fastify/express versions 4.0.5 through 4.0.8 with path-scoped Express middleware protecting routes, and that have the non-default ignoreDuplicateSlashes option enabled. Apps on the default setting or on 4.0.9 or later are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112362","severity":null,"published_at":"2026-10-27T12:17:04+00:00","modified_at":"2026-10-27T12:17:04+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","fetched_at":"2026-10-27T12:31:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}