External risk intelligence

Attacker can bypass security and access protected routes

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-33808

A security flaw in @fastify/express lets attackers bypass authentication on web applications by manipulating URLs, potentially exposing protected routes.

4Halo Surface Signal

Fastify\/express

before 4.0.5

External exposure likelihood

Halo Surface Signal score for CVE-2026-33808

The affected component is middleware used to build web applications and APIs. Since applications built with these frameworks are frequently deployed as internet-facing web services to deliver public content and functional APIs, the vulnerable authentication bypass surface is typically reachable from the public internet in standard deployment scenarios.

Horizon Alert

Summary of the vulnerability and why it matters

This issue allows unauthenticated access to protected parts of a web application. It occurs when a specific configuration in the Fastify router is enabled, causing it to normalize URLs differently than the Express middleware, which can be tricked into skipping security checks. This means attackers could potentially reach sensitive routes without needing any credentials.

Bypasses path security.
Affects web applications and APIs.
Reachable from the internet.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this flaw to bypass path-scoped authentication middleware by manipulating URLs with duplicate slashes or semicolon delimiters, depending on the Fastify router normalization configuration. This allows access to protected routes that would otherwise be inaccessible.

Target: Web applications using @fastify/express
Action: Craft malicious URL
Precondition: Specific router normalization enabled

Live Threat

Current exploitation, exposure, and threat context

Attackers may find this vulnerability appealing due to its ability to bypass authentication, potentially granting unauthorized access to protected routes. The mechanism involves manipulating URLs to circumvent security measures within the Fastify and Express integration. While direct exploitation is possible, the effectiveness depends on specific application configurations.

Exploitation requires specific configuration.
No public exploit code is readily available.
Vulnerability was disclosed recently.

Priority actions

Operational Fix

Recommended remediation, mitigation, and detection steps

Prioritize upgrading `@fastify/express` to version 4.0.5 or later to address the authentication bypass vulnerability. Monitor traffic for requests containing duplicate slashes or semicolon delimiters in URL paths, which could indicate an attempt to exploit this issue.

Upgrade `@fastify/express` to 4.0.5.
Block suspicious URL patterns.
Monitor for bypass attempts.

Frequently asked questions

What is @fastify/express and how is it used in web development?

@fastify/express is a component that facilitates the use of Express middleware within Fastify applications. It's employed to build web applications and APIs, acting as a bridge to leverage the extensive middleware ecosystem of Express within the Fastify framework.

What type of vulnerability does CVE-2026-33808 represent and what is its root cause?

CVE-2026-33808 is a URL normalization vulnerability rooted in the discrepancy between Fastify's router URL normalization and how @fastify/express passes URLs to Express middleware. When specific Fastify router normalization options are active, it fails to normalize URLs consistently, creating an avenue for bypass.

How can an attacker exploit CVE-2026-33808 to bypass security controls?

An attacker can exploit this by crafting specially manipulated URLs. Depending on the Fastify router's configuration for handling duplicate slashes or semicolon delimiters, these manipulated URLs can bypass path-scoped authentication middleware because @fastify/express passes the un-normalized URL to Express middleware, which then fails to match and is skipped.

What is the relevance of CVE-2026-33808 in the context of web application security, considering its impact on authentication bypass?

This vulnerability is highly relevant as it allows an unauthenticated attacker to bypass path-scoped authentication middleware. The ability to access protected routes without valid credentials makes it a critical issue for any web application or API built with the affected versions of @fastify/express.

What actions should be taken to mitigate the risks associated with CVE-2026-33808?

The primary mitigation is to upgrade @fastify/express to version 4.0.5 or later. Additionally, monitoring network traffic for requests containing suspicious URL patterns, such as duplicate slashes or semicolon delimiters, can help detect potential exploitation attempts.

References

Written by Nicholas Merritt

External-surface CVE analysis and Halo Surface Signal prioritization for Halo Threat Intelligence.