CVE-2026-112362: Auth Middleware Bypass in @fastify/express via Absolute-Form Request Targets

Summary

CVE-2026-112362 is a critical authentication-bypass vulnerability in @fastify/express, the Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when the non-default ignoreDuplicateSlashes option is enabled, an absolute-form request target can reach a scoped route handler while its authentication, authorization, or rate-limiting middleware is skipped. The flaw is fixed in 4.0.9.

Technical Analysis

@fastify/express exists so that Fastify applications can reuse Express middleware. Middleware registered with a path scope — for example an admin path — is expected to run whenever a request resolves to that scope, enforcing checks such as authentication, authorization, or rate limiting before the handler executes.

The defect requires Fastify to run with the non-default ignoreDuplicateSlashes option enabled. That option normalizes URLs containing repeated slashes. Per the advisory, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target’s scheme — the // following http: in a request line such as GET http://host/path HTTP/1.1, rather than the usual origin-form GET /path HTTP/1.1.

The result is an interpretation conflict, tracked as CWE-436: two components interpret the same request differently. Fastify’s router resolves the normalized request to the scoped path and runs the handler. The Express layer, matching path-scoped middleware against the same URL, no longer sees that path — so middleware scoped to it, including authentication, authorization, or rate limiting, never runs.

The security consequence is direct: a request using an absolute-form target reaches a handler on a scoped route while the middleware protecting that route is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled — no credentials and no user interaction. The advisory does not fully disclose the internal string-handling details, but the divergence between router resolution and middleware matching is the core defect.

Affected Software and Versions

Product: @fastify/express, a Fastify plugin that runs Express middleware inside Fastify; the advisory is published under the fastify/fastify-express GitHub repository.
Affected versions: 4.0.5 through 4.0.8.
Fixed in: 4.0.9 — users should upgrade to 4.0.9 or later.
Exploitation precondition: Fastify running with the non-default ignoreDuplicateSlashes option enabled.

Impact

CVSS 9.1 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). An unauthenticated attacker can reach handlers on scoped routes — such as admin paths — while authentication, authorization, or rate-limiting middleware is skipped, yielding high confidentiality and integrity impact. Availability is unaffected (A:N), and exploitation requires no privileges or user interaction.

Exploitation Scenario

Illustrative scenario derived from the advisory description; actual scoped routes and middleware depend on the deployment.

The target runs @fastify/express 4.0.5–4.0.8 with Fastify’s ignoreDuplicateSlashes option enabled. Express middleware performing authentication is registered scoped to an admin path.
The attacker sends a request using an absolute-form request target pointing at that admin path.
Duplicate-slash normalization collapses the separator after the scheme in the absolute-form target.
Fastify’s router resolves the request to the scoped admin path and runs the handler.
The Express layer no longer sees that path, so the authentication middleware scoped to it is skipped.
The handler executes unauthenticated and the attacker receives its response, bypassing the intended access control.

Detection and Mitigation

Upgrade: move to @fastify/express 4.0.9 or later, where the issue is fixed.
Workaround 1: enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request.
Workaround 2: leave ignoreDuplicateSlashes at its default instead of enabling it.
Detection: inventory deployments running 4.0.5–4.0.8 with ignoreDuplicateSlashes enabled, and review access logs for absolute-form request targets.

Proof-of-Concept: curl and Burp

The advisory’s example of a scoped route is an admin path, and the attack vector is an absolute-form request target. Replace /admin with the scoped route actually protected by Express middleware, and <TARGET> with the authorized test host.

curl -k --request-target "http://<TARGET>/admin" "http://<TARGET>/admin"

The –request-target flag makes curl send the absolute-form request target described in the advisory.

GET http://<TARGET>/admin HTTP/1.1
Host: <TARGET>

For authorized testing only — test only systems you are permitted to test.

Bug Bounty Angle

Exploitation requires the non-default ignoreDuplicateSlashes option, so first probe whether the target behaves as if duplicate-slash normalization is enabled. Send absolute-form requests to scoped routes — admin panels, protected APIs — and compare responses against an unauthenticated baseline. A scoped handler returning protected data without credentials is a strong authentication-bypass report; test only systems you are authorized to assess.

Frequently Asked Questions

Which versions of @fastify/express are affected by CVE-2026-112362?

Versions 4.0.5 through 4.0.8 are affected. The issue is fixed in 4.0.9, and users should upgrade to 4.0.9 or later.

What does an attacker need to exploit CVE-2026-112362?

Only the non-default ignoreDuplicateSlashes option enabled on the target. An unauthenticated attacker then sends an absolute-form request so Fastify runs the scoped handler while Express middleware such as authentication is skipped.

Discovery and credits: CVE-2026-112362 was discovered by agent-killjoy, mcollina, and UlisesGascon; the CVE was assigned by OpenJS.