CVE-2026-33807 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time,...

CVE-2026-33807

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time,...

CVE-2026-33807 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time,...

CVE-2026-33808

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or...

CVE-2026-33808

CVE-2026-33808 affects fastify/express. Root cause: @fastify/express v4.0.4 and earlier fail to normalize URLs before passing to Express middleware when Fastify router normalization is enabled, allowing bypass of path-scoped authentication via duplicate slashes or semicolon delimiters. Outcome: a...

CVE-2026-33808 @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or...

@adbl/cartridge (>=0.0.3, <=0.0.5), @agrume/cli (3.0.0) +31 more potentially affected by CVE-2026-33808 via @fastify/express (>=1.1.0, <=4.0.2)

@fastify/express NPM version =1.1.0, =0.0.3, =2.0.0-beta.0, =8.0.0, =3.0.0-alpha-1, =0.29.0, =1.0.0-alpha.1, =1.0.0-beta-cloud-customizer.1, =1.0.0, =0.0.0-canary-20250922152503, =0.0.0-canary-20250922152503, =0.0.0-canary-20251023225836, =2.4.1-beta.1, =1.0.0, =1.6.0 and more Source cves:...

CVE-2026-33808 @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or...

CVE-2026-33808 @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or...

CVE-2026-33806

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify = 5.3...

0uth (>=1.0.5, <=1.2.1), @___d/common (>=1.0.3, <=1.0.27) +2538 more potentially affected by CVE-2026-33806 via fastify (>=4.29.0, <=5.8.4)

fastify NPM version =4.29.0, =1.0.5, =1.0.3, =0.0.3, =0.1.0, =0.1.0, =0.0.1, =0.1.6, =1.0.0, =3.0.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.2.0 - @agentspec/sidecar 0.1.0 and more Source cves: CVE-2026-33806 Source advisory: SNYK:JS-FASTIFY-16066793...

Improper Validation of Specified Type of Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the schema.body.content when a space is prepended to the Content-Type header. An attacker can bypass input validation by sending...

@chainlink/external-adapter-framework (>=1.7.5, <=1.7.7), @intuned/runtime (1.3.15) +89 more potentially affected by CVE-2026-33806 via fastify (4.29.0)

fastify NPM version 4.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastify and may be impacted: - @chainlink/external-adapter-framework =1.7.5, =1.3.14-ts-runtime-helpers, =0.0.0-a2a-20250421213654, =3.26.12-beta.2, =0.0.2, =0.3.23, =1.1.26,...

CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify = 5.3...

CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify = 5.3...

CVE-2026-33806

Summary: CVE-2026-33806 affects Fastify where, in applications using schema.body.content, a leading space in the Content-Type header can bypass per-content-type body validation while the body is parsed normally. This is a regression introduced in Fastify &gt;= 5.3.2 as a follow-up to CVE-2025-324...

CVE-2026-33806

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify = 5.3...

CVE-2026-33806 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header

Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation is skipped. This is a regression introduced in fastify = 5.3...

@amedia/brick-mcp (>=0.0.0-vBRAND-20260313141110, <=1.0.3), @andesite-lab/andesite-core (>=1.60.2, <=1.62.0) +321 more potentially affected by CVE-2026-33806 via fastify (>=5.0.0, <=5.8.4)

fastify NPM version =5.0.0, =0.0.0-vBRAND-20260313141110, =1.60.2, =2.0.1, =1.1.1, =0.6.2, =0.1.1, =0.1.1, =0.6.0, =0.1.1, =0.0.35, =0.0.82, =0.0.1, =0.0.6, =0.1.68, =0.1.130 and more Source cves: CVE-2026-33806 Source advisory: MEND:CVE-2026-33806...

PT-2026-54605

Уязвимость фреймворка Fastify программной платформы Node.js связана с неправильной проверкой указанного типа входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, обойти существующие механизмы защиты...