---
id: "CVE-2026-112362"
kind: "vulnerability"
aliases: ["CVE-2026-112362"]
title: "@fastify/express: absolute-form URLs can skip Express auth middleware on scoped routes"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["express-middleware", "fastify", "node", "package", "self-hosted"]
not_affected_if: ["default-config", "fixed-version"]
published_at: "2026-10-27T12:17:04+00:00"
first_seen_at: "2026-10-27T12:31:37+00:00"
updated_at: "2026-10-27T12:31:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112362", "first_seen_at": "2026-10-27T12:31:37+00:00"}]
---

# @fastify/express: absolute-form URLs can skip Express auth middleware on scoped routes

When Fastify's non-default ignoreDuplicateSlashes option is on, a request with an absolute-form target can reach a scoped route such as an admin path. Express middleware for authentication, authorization or rate limiting is skipped in that case.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npm ls @fastify/express` to find the installed version; 4.0.5 through 4.0.8 are affected.
- Search the Fastify setup for `ignoreDuplicateSlashes` set to `true`.

## Fix

- Upgrade `@fastify/express` to `4.0.9` or later.
- Or leave `ignoreDuplicateSlashes` at its default.
- Workaround from the sources: enforce authentication in a Fastify hook such as `preHandler`, which runs after the router resolves the request.

## Timeline

- 2026-10-27T12:31:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112362

## From the sources

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_