The vulnerability arises because @fastify/express does not normalize incoming URLs before forwarding them to Express middleware when Fastify router normalization options are enabled. When the Fastify option ignoreDuplicateSlashes or useSemicolonDelimiter is active, the router normalizes the path to select the route, but the original un‑normalized URL reaches the Express middleware. Consequently, middlewares that protect routes by inspecting the path are bypassed, allowing an unauthenticated attacker to reach protected endpoints without verification. This flaw directly maps to CWE-436, which describes failure to properly validate or sanitize inputs.

Vendors and products affected are the fastify:@fastify/express package, specifically all releases prior to version 4.0.5. Organizations that deploy this package and rely on the ignoreDuplicateSlashes or useSemicolonDelimiter router options are at risk. No other vendors are listed in the CNA data as affected.

The CVSS score of 9.1 indicates a high severity, and the EPSS score is not available, but the lack of availability does not reduce the potential impact. The vulnerability has been verified as not listed in CISA's KEV catalog, meaning that known exploitation in the wild has not been documented. Based on the description, the likely attack vector is via HTTP requests sent to routes that depend on path-based authorization. An attacker merely needs to craft a URL containing duplicate slashes or semicolon delimiters to trigger the bypass. Successful exploitation results in unauthorized access to any resource protected by the Express middleware.