CVE-2026-112362: 
JavaScript vulnerability analysis and mitigation

CVE-2026-112362 is an authentication bypass vulnerability in @fastify/express, a Fastify plugin that runs Express middleware inside Fastify. When Fastify is configured with the non-default ignoreDuplicateSlashes: true option, attackers can craft requests using absolute-form request targets to bypass path-scoped Express middleware (such as authentication, authorization, or rate limiting) and reach protected routes like admin endpoints. The vulnerability affects @fastify/express versions 4.0.5 through 4.0.8 (inclusive), and was disclosed on October 27, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is an interpretation conflict (CWE-436) between Fastify's router (find-my-way) and the Express middleware layer when ignoreDuplicateSlashes is enabled. When this option is active, duplicate-slash normalization collapses the // separator following the scheme in an absolute-form request target (e.g., GET http://host/admin/dashboard), causing Fastify's router to resolve the request to the scoped path and dispatch the handler — while the Express layer no longer recognizes the scoped path and skips its associated middleware. This means middleware registered via app.use('/admin', authMiddleware) is entirely bypassed. The vulnerability was introduced as a side effect of the fix for a related bypass (GHSA-6hw5-45gm-fj88 / CVE-2026-33808), and a parallel issue exists in @fastify/middie (GHSA-hx87-8wv7-pjv8 / CVE-2026-85184) (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass authentication, authorization, and rate-limiting middleware on any path-scoped Express route, gaining unauthorized access to protected endpoints such as admin panels or privileged APIs. Both confidentiality and integrity are rated High, as an attacker could read sensitive data and perform unauthorized write operations on protected resources. Availability is not directly impacted by this vulnerability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only that the target application has enabled the non-default ignoreDuplicateSlashes option, making it low-complexity for any attacker who can identify such deployments (GitHub Advisory).

1. Reconnaissance: Identify applications using @fastify/express versions 4.0.5–4.0.8 with routerOptions.ignoreDuplicateSlashes: true enabled. This may be inferred from HTTP response headers, error messages, or open-source repository inspection.
2. Identify protected routes: Enumerate scoped routes protected by Express middleware (e.g., /admin, /api/internal) through application mapping, documentation, or fuzzing.
3. Craft absolute-form request: Construct an HTTP request using an absolute-form request target, such as GET http://target-host/admin/dashboard HTTP/1.1, instead of the standard origin-form (GET /admin/dashboard HTTP/1.1).
4. Send the request: Transmit the crafted request to the server. Fastify's router normalizes the duplicate slashes introduced by the absolute-form scheme separator and resolves the path to the scoped route, dispatching the handler.
5. Bypass middleware: The Express layer, after normalization, no longer matches the scoped path, so authentication/authorization middleware is skipped and the handler executes with no credential check.
6. Access protected resource: The attacker receives the response from the protected endpoint (e.g., admin dashboard data) without having authenticated (GitHub Advisory).

• Network: HTTP requests using absolute-form request targets (e.g., GET http://hostname/admin/... rather than GET /admin/...) in server access logs, particularly targeting scoped/protected paths.
• Logs: Access log entries showing successful (2xx) responses to admin or restricted endpoints from unauthenticated sessions or sessions lacking expected authorization headers/cookies.
• Logs: Absence of expected authentication middleware log entries (e.g., auth token validation logs) for requests that successfully reached protected handlers.
• Application Behavior: Unexpected access to admin or privileged API endpoints without corresponding authentication events in application or identity provider logs.

The issue is fixed in @fastify/express version 4.0.9; all users running versions 4.0.5–4.0.8 should upgrade immediately. If an immediate upgrade is not possible, two workarounds are available: (1) disable the ignoreDuplicateSlashes option by leaving it at its default value (false), or (2) enforce authentication and authorization in a Fastify hook such as preHandler that executes after the router resolves the request, rather than relying solely on path-scoped Express middleware (GitHub Advisory).

The advisory was published by Fastify maintainer mcollina on GitHub on October 27, 2026, with remediation credited to UlisesGascon. The report notes AI assistance was used in its submission. No significant broader media coverage or notable independent researcher commentary has been identified at this time (GitHub Advisory).