PT-2026-33034 · Npm · Fastify-Express

Climba03003 + 3 · Published 2026-04-15 · Updated 2026-04-28 · CVE-2026-33807

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions @fastify/express versions prior to 4.0.5

Description A path handling bug in the onRegister() function causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix matching a middleware path, the path is prefixed a second time, preventing it from matching incoming requests. This leads to a complete bypass of Express middleware security controls, such as authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes.

Recommendations Upgrade to version 4.0.5 or later.

Exploit

Fix

Weakness Enumeration

CWE-436

Related Identifiers

BDU:2026-05651

CVE-2026-33807

GHSA-HRWM-HGMJ-7P9C

Affected Products

Fastify-Express

References · 13

• 🔥 https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33807 · Security Note
• https://cna.openjsf.org/security-advisories.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hrwm-hgmj-7p9c · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05651 · Security Note
• https://github.com/fastify/fastify-express · Note
• https://twitter.com/kom_256/status/2044355641527939129 · Twitter Post
• https://twitter.com/CVEnew/status/2044738007731757427 · Twitter Post
• https://twitter.com/_cvereports/status/2049068736460501226 · Twitter Post
• https://twitter.com/pulsepatchio/status/2044619266566111381 · Twitter Post
• https://twitter.com/infoflowcloud/status/2044739596865441873 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sn0wwt/resumen_diario_de_vulnerabilidades_16042026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2044520685792338045 · Twitter Post