CVE-2026-33807 fastify CVE debrief

Who should care

Organizations running Node.js applications with @fastify/express ≤4.0.4 that rely on Express middleware for security boundaries in nested or prefixed plugin architectures. This includes applications using express-session, passport, express-rate-limit, or custom authentication/authorization middleware within Fastify child plugins.

Technical summary

The `onRegister` hook in @fastify/express ≤4.0.4 incorrectly concatenates plugin prefixes onto middleware paths that already contain the same prefix. When a child plugin inherits middleware from a parent scope, the middleware's path string is prefixed again with the child's prefix, producing a doubled path (e.g., `/api/api/auth`). This malformed path never matches legitimate incoming requests, so Express middleware mounted at the original path fails to execute for all routes within the affected child plugin scope. The result is a complete security control bypass with no user interaction or special request crafting required.

Defensive priority

critical

Recommended defensive actions

• Upgrade @fastify/express to version 4.0.5 or later immediately.
• Audit all child plugin registrations that use path prefixes matching middleware paths to identify potentially affected scopes.
• Verify that authentication, authorization, and rate-limiting middleware are executing correctly in child plugin routes after upgrading.
• Review application logs for unexpected middleware bypass behavior in nested plugin configurations prior to the upgrade.
• Subscribe to Fastify and OpenJS Foundation security advisories for future vulnerability notifications.

Evidence notes

The vulnerability description and affected versions are sourced from the official NVD record. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and score of 9.1 are taken from NVD metadata. The CWE-436 classification is attributed to the OpenJS Foundation CNA reference. Vendor advisory and mitigation details are confirmed through GitHub Security Advisory GHSA-hrwm-hgmj-7p9c. The fix version 4.0.5 is explicitly stated in the CVE description and vendor advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.