fastify/fastify-express Security Advisories | GitStock

critical2026-04-16

@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

GHSA-6hw5-45gm-fj88 · CVE-2026-33808

critical2026-04-16

@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes

GHSA-hrwm-hgmj-7p9c · CVE-2026-33807

high2026-01-20

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

GHSA-g6q3-96cp-5r5m · CVE-2026-22037