CVE-2026-33808

When Fastify router normalization options are enabled (ignoreDuplicateSlashes or useSemicolonDelimiter), the Fastify router normalizes the incoming URL and correctly matches the route. However, @fastify/express passes the original, unmodified URL to Express middleware, which does not match protected path patterns — effectively bypassing authentication middleware. An attacker can, for example, add double slashes (e.g., //admin) or use a semicolon as a separator in the URL to bypass identity verification and directly access a protected resource.

An unauthenticated attacker can gain unauthorized access to protected application routes, potentially reading or modifying data that requires authentication.

Update @fastify/express to version 4.0.5 or later, which fixes URL normalization before passing the request to Express middleware.

@fastify/express version 4.0.4 and earlier, when the ignoreDuplicateSlashes or useSemicolonDelimiter option is enabled in the Fastify router configuration