Interpretation Conflict

Overview @fastify/express is an Express compatibility layer for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via the normalizeUrl function in index.js when the non-default ignoreDuplicateSlashes option is enabled. When an absolute-form request target e.g...

@bedrock/express (8.6.5) potentially affected by CVE-2026-112362 via @fastify/express (4.0.5)

@fastify/express NPM version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/express and may be impacted: - @bedrock/express 8.6.5 Source cves: CVE-2026-112362 Source advisory: SNYK:JS-FASTIFYEXPRESS-21755407...

CVE-2026-112362

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has...

EUVD-2026-110753

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has...

CVE-2026-112362 @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has...

@bedrock/express (8.6.5) potentially affected by CVE-2026-112362 via @fastify/express (4.0.5)

@fastify/express NPM version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/express and may be impacted: - @bedrock/express 8.6.5 Source cves: CVE-2026-112362 Source advisory: MEND:CVE-2026-112362...

CVE-2026-112362

The @fastify/express plugin (versions 4.0.5 through 4.0.8 ) is vulnerable to a path-scoped middleware bypass when the non-default ignoreDuplicateSlashes option is enabled. The root cause involves a discrepancy in how duplicate-slash normalization is handled; an absolute-form request target can ca...

CVE-2026-112362 @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has...

CVE-2026-112362

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has...

PT-2026-126386

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has...

@fastify/express processing logic error vulnerability

In versions 4.0.5 through 4.0.8 of @fastify/express, there is a logic error vulnerability. This arises when the non-default “ignoreDuplicateSlashes” option is enabled; repeated slashes are normalized, leading to inconsistent path resolution by Express middleware and the Fastify router for...

Incorrect Behavior Order

Overview @fastify/express is an Express compatibility layer for Fastify Affected versions of this package are vulnerable to Incorrect Behavior Order due to incorrect mount path prefix rewriting in the use middleware handling. An attacker can reach protected routes without the intended middleware ...

@bedrock/express (8.6.5), @cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6) +1 more potentially affected by CVE-2026-6556 via @fastify/express (>=4.0.1, <=4.0.5)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-6556 Source advisory: SNYK:JS-FASTIFYEXPRESS-17744444...

CVE-2026-6556

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths arrays of paths and regular expressions are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms doe...

CVE-2026-6556 @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths arrays of paths and regular expressions are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms doe...

CVE-2026-6556 @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths arrays of paths and regular expressions are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms doe...

EUVD-2026-40309

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths arrays of paths and regular expressions are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms doe...

CVE-2026-6556 @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths arrays of paths and regular expressions are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms doe...

CVE-2026-6556

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths arrays of paths and regular expressions are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms doe...

@adbl/cartridge (>=0.0.3, <=0.0.5), @agrume/cli (3.0.0) +31 more potentially affected by CVE-2026-6556 via @fastify/express (>=1.1.0, <=4.0.5)

@fastify/express NPM version =1.1.0, =0.0.3, =2.0.0-beta.0, =8.0.0, =3.0.0-alpha-1, =0.29.0, =1.0.0-alpha.1, =1.0.0-beta-cloud-customizer.1, =1.0.0, =0.0.0-canary-20250922152503, =0.0.0-canary-20250922152503, =0.0.0-canary-20251023225836, =2.4.1-beta.1, =1.0.0, =1.6.0 and more Source cves:...