PT-2026-3452 · Fastify+1 · Fastify+1

Rootxharsh · Published 2026-01-19 · Updated 2026-01-20 · CVE-2026-22037

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions @fastify/express versions prior to 4.0.3

Description A security issue exists in the @fastify/express plugin, which provides Express compatibility for Fastify. The problem occurs when middleware is registered with a specific path prefix. Attackers can bypass the middleware by using URL-encoded characters in the request path, such as /%61dmin instead of /admin. The Fastify router correctly decodes the path and matches the route handler, allowing access to protected endpoints without the intended middleware restrictions. This bypass is due to how @fastify/express matches requests against registered middleware paths.

Recommendations Update to @fastify/express version 4.0.3 or later.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

CWE-177

Related Identifiers

CVE-2026-22037

GHSA-G6Q3-96CP-5R5M

Affected Products

Fastify-Express

Fastify

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22037.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-22037 · Security Note
• https://osv.dev/vulnerability/GHSA-g6q3-96cp-5r5m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22037 · Vendor Advisory
• https://github.com/fastify/fastify-express · Note
• https://github.com/fastify/fastify-express/security/advisories/GHSA-g6q3-96cp-5r5m · Note
• https://github.com/fastify/fastify-express/releases/tag/v4.0.3 · Note
• https://github.com/fastify/fastify-express/commit/dc02a3fe1387f945143f22597baa42557d549a40 · Note
• https://twitter.com/CVEnew/status/2013300673878675905 · Twitter Post
• https://twitter.com/TheHackerWire/status/2013301617643397451 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2013321747488006221 · Twitter Post