CRITICAL9.1npm
GHSA-6hw5-45gm-fj88· CVE-2026-33808@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Modified: 9/10/2026
package
npm/@fastify/express
pkg:npm/%40fastify/express
HIGH8.4npm
GHSA-g6q3-96cp-5r5m· CVE-2026-22037@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
Modified: 2/3/2026
CRITICAL9.1npm
GHSA-hrwm-hgmj-7p9c· CVE-2026-33807@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes
Modified: 7/8/2026