CVE-2026-6556
- EPSS 0.3%
- Veröffentlicht 30.06.2026 13:19:25
- Zuletzt bearbeitet 01.07.2026 15:57:54
@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scop...
CVE-2026-33807
- EPSS 0.43%
- Veröffentlicht 15.04.2026 09:52:26
- Zuletzt bearbeitet 01.06.2026 15:29:13
@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, th...
CVE-2026-33808
- EPSS 0.48%
- Veröffentlicht 15.04.2026 09:29:46
- Zuletzt bearbeitet 01.06.2026 15:20:30
Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slas...