CVE-2026-33808

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or via semicolon delimiters when useSemicolonDelimiter is enabled. In both cases, Fastify router normalizes the URL and matches the route, but @fastify/express passes the original un-normalized URL to Express middleware, which fails to match and is skipped. An unauthenticated attacker can access protected routes by manipulating the URL path. PatchesUpgrade to @fastify/express v4.0.5 or later.

• CWE-436

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fastify-express/security/advisories/GHSA-6hw5-45gm-fj88Exploit, Mitigation, Vendor Advisory
• https://github.com/fastify/fastify-express/security/advisories/GHSA-6hw5-45gm-fj88Exploit, Mitigation, Vendor Advisory

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33802A Missing Authorization vulnerability in the CLI of Juniper …6.8
• CVE-2026-33803An Improper Restriction of Communication Channel to Intended…6.9
• CVE-2026-33804@fastify/middie versions 9.3.1 and earlier are vulnerable to…9.1
• CVE-2026-33805@fastify/reply-from v12.6.1 and earlier and @fastify/http-pr…8.6
• CVE-2026-33806Impact: Fastify applications using schema.body.content for …7.5
• CVE-2026-33807@fastify/express v4.0.4 and earlier contains a path handling…9.1
• CVE-2026-33809A maliciously crafted TIFF file can cause image decoding to …5.3
• CVE-2026-3381Compress::Raw::Zlib versions through 2.219 for Perl use pote…9.8
• CVE-2026-33810When verifying a certificate chain containing excluded DNS c…8.2
• CVE-2026-33811When using LookupCNAME with the cgo DNS resolver, a very lon…7.5
• CVE-2026-33812Parsing a malicious font file can cause excessive memory all…6.1
• CVE-2026-33813Parsing a WEBP image with an invalid, large size panics on 3…7.5