Skip to content

chore(deps): update dependency @fastify/express to v4 [security]#3351

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-fastify-express-vulnerability
Open

chore(deps): update dependency @fastify/express to v4 [security]#3351
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-fastify-express-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jan 20, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
@fastify/express ^3.0.0 → ^4.0.3 age confidence

GitHub Vulnerability Alerts

CVE-2026-22037

Summary

A security vulnerability exists in @fastify/express where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., /%61dmin instead of /admin). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints.

Details

The vulnerability is caused by how @fastify/express matches requests against registered middleware paths.

PoC

Step 1: Run the following Fastify application (save as app.js):

const fastify = require('fastify')({ logger: true });

async function start() {
  // Register fastify-express for Express-style middleware support
  await fastify.register(require('@​fastify/express'));

  // Middleware to block /admin route
  fastify.use('/admin', (req, res, next) => {
    res.statusCode = 403;
    res.end('Forbidden: Access to /admin is blocked');
  });

  // Sample routes
  fastify.get('/', async (request, reply) => {
    return { message: 'Welcome to the homepage' };
  });

  fastify.get('/admin', async (request, reply) => {
    return { message: 'Admin panel' };
  });

  fastify.get('/admin/dashboard', async (request, reply) => {
    return { message: 'Admin dashboard' };
  });

  // Start server
  try {
    await fastify.listen({ port: 3000 });
  } catch (err) {
    fastify.log.error(err);
    process.exit(1);
  }
}

start();

Step 2: Execute the attack.

➜  ~ curl http://206.189.140.29:3000/%61dmin
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
</head>
<body>
<pre>Cannot GET /%61dmin</pre>
</body>
</html>

(fastify express)

➜  ~ curl http://206.189.140.29:3000/%61dmin
{"message":"Admin panel"}

It differs from CVE-2026-22031 because this is a different npm module with its own code.

Release Notes

fastify/fastify-express (@​fastify/express)

v4.0.3

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify-express@v4.0.2...v4.0.3

v4.0.2

Compare Source

What's Changed

Full Changelog: fastify/fastify-express@v4.0.1...v4.0.2

v4.0.1

Compare Source

What's Changed

Full Changelog: fastify/fastify-express@v4.0.0...v4.0.1

v4.0.0

Compare Source

What's Changed

Full Changelog: fastify/fastify-express@v3.0.0...v4.0.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner January 20, 2026 20:39
@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jan 20, 2026
@github-actions github-actions bot added pkg:instrumentation-fastify pkg-status:unmaintained This package is unmaintained. Only bugfixes may be acceped until a new owner has been found. labels Jan 20, 2026
@renovate renovate bot force-pushed the renovate/npm-fastify-express-vulnerability branch 4 times, most recently from 35a4f08 to 53071cf Compare January 22, 2026 08:56
@renovate renovate bot force-pushed the renovate/npm-fastify-express-vulnerability branch 3 times, most recently from fa76383 to d441445 Compare February 5, 2026 07:28
@renovate renovate bot force-pushed the renovate/npm-fastify-express-vulnerability branch from d441445 to 4f1fe51 Compare February 5, 2026 07:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@trentm trentm

@dyladan dyladan

@legendecas legendecas

@pichlermarc pichlermarc

Labels

dependencies Pull requests that update a dependency file pkg:instrumentation-fastify pkg-status:unmaintained This package is unmaintained. Only bugfixes may be acceped until a new owner has been found.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@trentm @dyladan @legendecas @pichlermarc