CVE-2026-6556: @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string m...

Description

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authentication, authorization, rate limiting, or auditing on routes inside a prefixed scope can be bypassed by sending a request to the prefixed route, because Fastify still matches the route but the middleware is skipped. Patches: upgrade to @fastify/express 4.0.7. Workarounds: use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path.

Metrics

CVSS 3.1

9.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Probability

0.31%

22.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-285

Affected Software

Vendor	Product	Versions
Fastify	Fastify\/Express	< 4.0.7

References

https://cna.openjsf.org/security-advisories.htmlVendor Advisory
https://github.com/fastify/fastify-express/security/advisories/GHSA-3wf5-7852-vcfqMitigation, Vendor Advisory

Timeline

Published: Jun 30, 2026
Last Modified: Jul 1, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-6556?

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authentication, authorization, rate limiting, or auditing on routes inside a prefixed scope can be bypassed by sending a request to the prefixed route, because Fastify still matches the route but the middleware is skipped. Patches: upgrade to @fastify/express 4.0.7. Workarounds: use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path.

How severe is CVE-2026-6556?

CVE-2026-6556 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 0.31% probability of exploitation in the next 30 days.

How do I fix CVE-2026-6556?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →