@fastify/express vulnerabilities
We track 2 vulnerabilities in @fastify/express products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
2vulnerabilities
2critical
0high
0exploited
9.1average CVSS score
Latest @fastify/express vulnerabilities
- 9.1 Critical severity
@fastify/express: Interpretation Conflict
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL who
- 9.1 Critical severity
@fastify/express: Improper Authorization
@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so mid