The bug in @fastify/express causes middleware paths to be doubled when inherited by child plugins. Because the duplicated prefix prevents the middleware from matching incoming requests, all Express security controls—authentication, authorization, and rate limiting—are completely bypassed for routes defined within affected child plugin scopes. This results in an attacker being able to access protected routes without any credentials or restrictions.

Any installation of @fastify/express version 4.0.4 or earlier that registers child plugins with prefixes is vulnerable. The affected vendor is fastify, and the product is the @fastify/express package. No other versions were listed as affected.

The CVSS score is 9.1, indicating a critical level of severity. The EPSS score is not available, so exploitation probability is unknown, but the vulnerability can be exploited remotely by simply accessing the application; no special configuration or request crafting is required. The attack vector is inferred to be remote network access. The vulnerability is not listed in the CISA KEV catalog.