Fastify Express Plugin Authentication Bypass via Duplicate Slash Handling

The @fastify/express plugin, which runs Express middleware inside Fastify, has a middleware bypass vulnerability affecting versions 4.0.5 through 4.0.8. When Fastify runs with the non-default ignoreDuplicateSlashes option enabled, path-scoped Express middleware is matched against a URL whose duplicate-slash normalization also collapses the separator after an absolute-form request target's scheme.

This lets Fastify's router resolve a request to the scoped path and run the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while authentication, authorization, or rate-limiting middleware is skipped.

• Affected versions: 4.0.5 through 4.0.8
• Requires the non-default ignoreDuplicateSlashes option to be enabled
• Fixed in @fastify/express 4.0.9

Users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.