CVE-2026-6556

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authentication, authorization, rate limiting, or auditing on routes inside a prefixed scope can be bypassed by sending a request to the prefixed route, because Fastify still matches the route but the middleware is skipped. Patches: upgrade to @fastify/express 4.0.7. Workarounds: use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cna.openjsf.org/security-advisories.html	Vendor Advisory
https://github.com/fastify/fastify-express/security/advisories/GHSA-3wf5-7852-vcfq	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fastify:fastify\/express:*:*:*:*:*:node.js:*:*

History

01 Jul 2026, 15:57

Type	Values Removed	Values Added
First Time		Fastify Fastify fastify\/express
CPE		cpe:2.3:a:fastify:fastify\/express::::::node.js::*
References	~~() https://cna.openjsf.org/security-advisories.html -~~	() https://cna.openjsf.org/security-advisories.html - Vendor Advisory
References	~~() https://github.com/fastify/fastify-express/security/advisories/GHSA-3wf5-7852-vcfq -~~	() https://github.com/fastify/fastify-express/security/advisories/GHSA-3wf5-7852-vcfq - Mitigation, Vendor Advisory

30 Jun 2026, 13:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-30 13:19

Updated : 2026-07-01 15:57

NVD link : CVE-2026-6556

Mitre link : CVE-2026-6556

CVE.ORG link : CVE-2026-6556

JSON object : View

Products Affected

fastify

fastify\/express

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-6556", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6556", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-30T13:30:22.928078Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "affectedData": [{"vendor": "@fastify/express", "product": "@fastify/express", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.7", "versionType": "semver"}, {"status": "unaffected", "version": "4.0.7", "versionType": "semver"}], "packageURL": "pkg:npm/@fastify/express", "defaultStatus": "unaffected"}]}], "published": "2026-06-30T13:19:25.467", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/fastify/fastify-express/security/advisories/GHSA-3wf5-7852-vcfq", "tags": ["Mitigation", "Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authentication, authorization, rate limiting, or auditing on routes inside a prefixed scope can be bypassed by sending a request to the prefixed route, because Fastify still matches the route but the middleware is skipped. Patches: upgrade to @fastify/express 4.0.7. Workarounds: use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path."}], "lastModified": "2026-07-01T15:57:54.630", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify\\/express:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B4044DBB-8BA0-425A-ADBA-EDA64830DEAE", "versionEndExcluding": "4.0.7"}], "operator": "OR"}]}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}