CVE-2026-112362

Summary

A path confusion flaw in @fastify/express (versions 4.0.5–4.0.8) allows unauthenticated attackers to bypass scoped middleware (e.g., auth or rate limiting) when Fastify’s ignoreDuplicateSlashes option is enabled, by sending a request with an absolute-form URI that collapses duplicate slashes after the scheme, causing Fastify to route to the protected path while Express skips its middleware.

Exploitability

Exploitation requires only the non-default ignoreDuplicateSlashes option to be enabled; no authentication or special privileges are needed.

Blast radius

An attacker could bypass critical security controls on admin or sensitive routes, leading to unauthorized access or privilege escalation depending on the affected application’s routing structure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to @fastify/express version 4.0.9 or later; alternatively, disable ignoreDuplicateSlashes (its default) or enforce authentication in a Fastify preHandler hook.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.