A vulnerability in the @fastify/express plugin allows an attacker to bypass middleware that protects certain paths by sending URL‑encoded characters that the middleware engine does not match. The Fastify router decodes the path before routing, so a request such as "/%61dmin" matches the protected route without the middleware being executed. This flaw is an example of Improper Input Validation (CWE‑177) and Improper Check of Exception Response (CWE‑288), enabling attackers to gain unauthorized access to endpoints that are otherwise restricted.

The issue affects the fastify:fastify‑express plugin in any Node.js application that uses @fastify/express version prior to 4.0.3. The vulnerability is present in every installation of the plugin that registers middleware with a specific path prefix before the patch is applied.

The risk is high, with a CVSS score of 8.4, yet the EPSS score is very low (<1%), indicating limited current exploitation activity. It is not listed in the CISA KEV catalog. The likely attack vector is remote, where an attacker crafts HTTP requests containing URL‑encoded paths to reach protected endpoints. No special privileges or additional network access are required beyond the ability to send HTTP traffic to the vulnerable application.