CVE-2026-33807: Fastify Express Auth Bypass Vulnerability

CVE-2026-33807 Overview

CVE-2026-33807 is an Authorization Bypass vulnerability in @fastify/express v4.0.4 and earlier. The vulnerability exists in the onRegister function, which contains a path handling bug that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match incoming requests.

This results in a complete bypass of Express middleware security controls, including authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. Critically, no special configuration or request crafting is required to trigger this vulnerability—it manifests automatically in vulnerable configurations.

Critical Impact

Complete bypass of Express middleware security controls including authentication, authorization, and rate limiting for all routes in affected child plugin scopes without any special exploit techniques required.

Affected Products

• @fastify/express v4.0.4 and earlier

Discovery Timeline

• 2026-04-15 - CVE CVE-2026-33807 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-33807

Vulnerability Analysis

This vulnerability is classified under CWE-436 (Interpretation Conflict), which occurs when two or more components that need to interpret input data differently interpret the same data inconsistently. In the context of @fastify/express, the path handling logic in the onRegister function incorrectly processes middleware paths during plugin inheritance.

When Express middleware is mounted at a specific path (e.g., /api), and a child plugin is subsequently registered with a matching prefix, the middleware path undergoes double-prefixing. For example, a middleware path of /api becomes /api/api internally. Since incoming requests use the original path structure, the doubled middleware path never matches, effectively disabling all middleware protections for routes within that child plugin's scope.

The impact is severe because authentication, authorization, and rate limiting middleware—commonly applied at prefix levels—become completely ineffective. An attacker can access protected endpoints without proper credentials or bypass rate limits designed to prevent abuse, all without any specialized attack techniques.

Root Cause

The root cause lies in the onRegister function's path inheritance logic. When a child plugin inherits middleware configurations from its parent, the function fails to account for scenarios where the child's registration prefix matches the middleware's target path. Instead of recognizing the existing path association, it prepends the prefix again, creating a non-functional doubled path that never matches actual request URLs.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. Any application using @fastify/express v4.0.4 or earlier with child plugins registered at prefixes matching middleware paths is automatically vulnerable. Attackers can simply send normal HTTP requests to protected endpoints; the middleware bypass occurs transparently due to the path mismatch.

The vulnerability does not require the attacker to craft specially formatted requests or exploit timing conditions. Standard requests to routes within affected child plugin scopes will bypass all middleware security controls, including:

• Authentication middleware (allowing unauthorized access)
• Authorization middleware (enabling privilege escalation)
• Rate limiting middleware (permitting abuse and DoS conditions)

Detection Methods for CVE-2026-33807

Indicators of Compromise

• Unexpected successful requests to authenticated endpoints without valid credentials in access logs
• Authentication or authorization middleware logging gaps for specific route prefixes
• Rate limiting counters not incrementing for requests to routes within child plugin scopes
• Anomalous access patterns to protected resources that should trigger middleware interception

Detection Strategies

• Audit application code for child plugin registrations where the prefix matches existing middleware paths
• Review access logs for requests to protected endpoints that lack corresponding middleware processing entries
• Implement integration tests that verify middleware execution for all routes, especially those in child plugin scopes
• Deploy Web Application Firewall (WAF) rules to monitor for unauthorized access attempts to normally protected endpoints

Monitoring Recommendations

• Enable detailed logging for middleware execution to identify routes where middleware is unexpectedly skipped
• Configure alerting for authentication failures followed by successful access to the same protected resource
• Monitor for sudden increases in traffic to rate-limited endpoints that don't trigger rate limit responses
• Implement application performance monitoring (APM) to track middleware execution paths across all routes

How to Mitigate CVE-2026-33807

Immediate Actions Required

• Upgrade to @fastify/express v4.0.5 or later immediately
• Audit existing applications for child plugin configurations with prefixes matching middleware paths
• Review recent access logs for potential exploitation of this vulnerability
• Consider temporarily disabling affected child plugins until the upgrade is complete

Patch Information

The vulnerability has been addressed in @fastify/express v4.0.5. Users should upgrade to this version or later to receive the fix. The patch corrects the path inheritance logic in the onRegister function to prevent double-prefixing of middleware paths.

For detailed information about the security fix, refer to the GitHub Fastify Express Security Advisory and the OpenJS Foundation Security Advisories.

Workarounds

• Avoid using child plugin prefixes that match middleware mount paths until the upgrade is applied
• Apply middleware directly within child plugin scopes rather than relying on inheritance from parent plugins
• Implement additional authentication checks at the route handler level as a defense-in-depth measure
• Use Fastify's native hooks (e.g., onRequest, preHandler) instead of Express middleware for security controls in affected applications

# Upgrade @fastify/express to the patched version
npm update @fastify/express@^4.0.5

# Verify the installed version
npm list @fastify/express