CVE-2026-22037

The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters e.g., /%61dmin instead of /admin. While the...

@cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6), mikr0 (0.1.10) potentially affected by CVE-2026-22037 via @fastify/express (>=4.0.1, <=4.0.2)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-22037 Source advisory: OSV:GHSA-G6Q3-96CP-5R5M...

@cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6), mikr0 (0.1.10) potentially affected by CVE-2026-22037 via @fastify/express (>=4.0.1, <=4.0.2)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-22037 Source advisory: SNYK:JS-FASTIFYEXPRESS-15038741...