fastify fastify-express up to 4.0.2 url encoding

Summaryinfo

A vulnerability marked as problematic has been reported in fastify fastify-express up to 4.0.2. This issue affects some unknown processing. The manipulation leads to url encoding. This vulnerability is uniquely identified as CVE-2026-22037. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in fastify fastify-express up to 4.0.2 and classified as problematic. This issue affects an unknown code. The manipulation with an unknown input leads to a url encoding vulnerability. Using CWE to declare the problem leads to CWE-177. The product does not properly handle when all or part of an input has been URL encoded. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. The vulnerability is caused by how @fastify/express matches requests against registered middleware paths. This vulnerability is similar to, but differs from, CVE-2026-22031 because this is a different npm module with its own code. Version 4.0.3 of @fastify/express contains a patch fort the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-22037 since 01/05/2026. The exploitation is known to be difficult. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.0.3 eliminates this vulnerability. Applying the patch dc02a3fe1387f945143f22597baa42557d549a40 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-3320). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• fastify

Name

• fastify-express

Version

• 4.0.0
• 4.0.1
• 4.0.2

License

• open-source

Website

• Product: https://github.com/fastify/fastify-express/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion