External risk intelligence

@fastify/express Middleware Skipping Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-112362

The vulnerability affects a plugin for Fastify, a web framework commonly used to build public-facing web applications, APIs, and microservices. Because this component is used to handle HTTP requests and middleware, it is typically present in internet-exposed web services, making it a likely component of an internet-facing application stack.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recently identified vulnerability in a Fastify plugin could allow attackers to bypass security controls like authentication or authorization on web applications. This issue arises when a specific configuration setting is enabled, potentially exposing sensitive application paths to unauthorized access. The core concern is confirming if this plugin is in use and if the specific configuration is active within your environment.

Bypasses security for web applications.
High risk if specific configuration is active.
Confirm usage and configuration relevance.

Attack Path

How an attacker could exploit the issue

An attacker could target a web application using a specific Fastify plugin. If the application is configured with a non-default setting that ignores duplicate slashes in URLs, an attacker could send a specially crafted request. This request, using an absolute-form target, would bypass security checks like authentication or authorization, potentially leading to unauthorized access to sensitive parts of the application, such as administrative functions.

Requires a non-default configuration.
Bypasses middleware checks via crafted URL.
Allows unauthenticated access to routes.

Live Threat

Current exploitation, exposure, and threat context

When the `ignoreDuplicateSlashes` option is enabled, requests using an absolute-form target could bypass middleware such as authentication or authorization checks, allowing access to protected routes.

Protected routes and their associated data.
Requests crafted with specific URL formats.
Unauthorized access to sensitive application areas.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability likely involves platform teams and application owners responsible for Fastify deployments. The first step is to inventory all instances of the affected plugin, confirm their reachability and business criticality, and identify the specific application or service owner. Subsequent remediation planning should be risk-based, considering factors like deployment scope and impact.

Platform or application owners should take charge.
Verify affected plugin usage and reachability.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is @fastify/express?

@fastify/express is a bridge plugin for the Fastify web framework. It allows developers to integrate existing Express.js middleware into Fastify applications, enabling them to reuse established middleware logic for authentication or request handling while benefiting from Fastify's performance.

How does CVE-2026-112362 bypass security?

This vulnerability, classified as CWE-436 (Interpretation Conflict), occurs when Fastify's URL normalization process disagrees with how Express middleware interprets the same request. By crafting a specific URL, an attacker can trick the system into routing the request to a protected handler while causing the security middleware to ignore that same path entirely.

What triggers this vulnerability in the plugin?

The flaw is only triggered when the non-default 'ignoreDuplicateSlashes' option is enabled in the Fastify configuration. If this setting is kept at its default, the vulnerability does not manifest. The attack specifically requires an absolute-form request target to confuse the router and middleware layers.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a likely risk because @fastify/express is commonly integrated into public-facing APIs and microservices. If your service is internet-exposed and uses this plugin with the specific non-default configuration, it provides a direct path for unauthorized access to sensitive application routes.

How do I address CVE-2026-112362?

The most effective resolution is to upgrade your @fastify/express dependency to version 4.0.9 or later. If you cannot update immediately, you can mitigate the risk by disabling the 'ignoreDuplicateSlashes' setting or by enforcing authentication within a Fastify preHandler hook, which executes after the router successfully resolves the request.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.