fastify express up to 4.0.4 onRegister interpretation conflict

Summaryinfo

A vulnerability labeled as critical has been found in fastify express up to 4.0.4. This impacts the function onRegister. The manipulation results in interpretation conflict. This vulnerability is identified as CVE-2026-33807. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in fastify express up to 4.0.4. Affected is the function onRegister. The manipulation with an unknown input leads to a interpretation conflict vulnerability. CWE is classifying the issue as CWE-436. Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match incoming requests. This results in complete bypass of Express middleware security controls, including authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. No special configuration or request crafting is required. Upgrade to @fastify/express v4.0.5 or later.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-33807 since 03/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 4.0.5 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• fastify

Name

• express

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion