@fastify/express is a Fastify plugin that allows Express middleware to run inside Fastify. Between versions 4.0.5 and 4.0.8, when Fastify is configured with ignoreDuplicateSlashes set to true, the plugin compares path‑scoped Express middleware against a request URL whose duplicate slashes are collapsed after the scheme. This causes Fastify’s router to resolve the request to a scoped path and execute the handler, but the Express layer no longer sees that path. As a result, requests that use an absolute‑form target can reach handlers on scoped routes—such as an admin path—while any Express middleware for authentication, authorization, or rate‑limiting is bypassed.

The vulnerability exists in the @fastify/express package, specifically versions 4.0.5 through 4.0.8. Upgrading to version 4.0.9 or later resolves the issue. No other vendors or products are listed as affected.

The CVSS score of 9.1 indicates a critical severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the application be running with the non‑default ignoreDuplicateSlashes option enabled and that a request use an absolute‑form target. The likely attack path is a remote HTTP request from an external client. Because the flaw is configuration‑dependent, the likelihood of exploitation in the wild is moderate.