CVE-2026-6556Patch(fastify / fastify\/express)

LOWCVSS 9.1 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch fastify fastify\/express systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authentication, authorization, rate limiting, or auditing on routes inside a prefixed scope can be bypassed by sending a request to the prefixed route, because Fastify still matches the route but the middleware is skipped. Patches: upgrade to @fastify/express 4.0.7. Workarounds: use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path.

fastify CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

fastify\/express

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
2 total mentions across 1 day

Affected systems

Vendors

fastify

Products

fastify\/express

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Patch

2100.0%

Referenced assets1 URL

By indicator

https://github.com/fastify/fastify-express/security/advisories/GHSA-3wf5-7852-vcfq

Full discourse2 posts

Ulises Gascón@kom_25692d
Patch
🚨 Critical-severity security fix in @fastify/express 4.0.7 just released! Patches CVE-2026-6556. @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins. https://github.com/fastify/fastify-express/security/advisories/GHSA-3wf5-7852-vcfq
Post summary
Fastify Express releases version 4.0.7 with a critical fix for CVE‑2026‑6556, addressing a middleware bypass flaw; the advisory link provides further details.
00010232
5.5K followersView on X
Upwind Security MDR@UpwindMDR91d
Patch
🚨 CRITICAL - Fastify plugin prefix bypass in Express middleware mounts (CVE-2026-6556) CVE-2026-6556 is a middleware scoping flaw in @fastify/express where plugin prefixes are not applied to middleware mount paths when the mount path is provided as an array or a regular expression. The root cause is improper input handling in prefix/path normalization, causing the middleware to be registered effectively unprefixed inside prefixed plugin scopes. An attacker can exploit this by sending requests to routes under a prefixed plugin where security middleware was mounted with array/regex paths, requiring no special privileges beyond network access to the service. Impact includes bypass of authentication/authorization/rate-limiting/auditing controls on affected prefixed routes, enabling unauthorized access and abuse. 👉 Affected: @fastify/express <= 4.0.6 | Upgrade to 4.0.7
Post summary
The post announces CVE‑2026‑6556, details the prefix bypass flaw and its impacts, and recommends upgrading to @fastify/express 4.0.7 as a patch.
0000060
232 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	fastify	fastify\/express	-	node.js	-

Explore more

Back to dashboard fastify CVEs fastify\/express vulnerabilities