{"schema":"threatline.record/2","record":{"id":"CVE-2026-112362","aliases":["GHSA-6h42-57hq-9746"],"summary":"@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets","details":"@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.","categories":["Frameworks"],"product":"@fastify/express","vendor":"@fastify/express","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112362","source_modified_at":"2026-10-27T11:27:59.364Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"@fastify/express","vendor":"@fastify/express","versions":[{"versionType":"semver","status":"affected","version":"4.0.5","lessThan":"4.0.9"},{"versionType":"semver","status":"unaffected","version":"4.0.9"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112362","source_modified_at":"2026-10-27T11:27:59.364Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"@fastify/express","ecosystem":null},"version":"4.0.9","basis":"first unaffected version stated in the CVE record"}],"cvss":9.1,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T11:27:59.364Z","modified_at":"2026-10-27T11:27:59.364Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112362","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T11:27:59.364Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/fastify/fastify-express/security/advisories/GHSA-6h42-57hq-9746"},{"source":"CVE List","url":"https://cna.openjsf.org/security-advisories.html"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T11:27:59.364Z","content_hash":"0b0c84fc0e20dfdc2a2c79801cdd6533197cd1468d0d56b38c998520322815db"}}