npmPackage

@fastify/express

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-33807Critical 9.1
@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes
Affected: fixed in 4.0.5.
Fixed in 4.0.5 (released Apr 15, 2026, the day of disclosure).
The latest release, 4.0.9, is not affected.
53% of @fastify/express downloads last week were affected versions (66.2K).
CVE-2026-33808Critical 9.1
@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Affected: fixed in 4.0.5.
Fixed in 4.0.5 (released Apr 15, 2026, the day of disclosure).
The latest release, 4.0.9, is not affected.
53% of @fastify/express downloads last week were affected versions (66.2K).
CVE-2026-22037High 8.4
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
Affected: fixed in 4.0.3.
Fixed in 4.0.3 (released Jan 5, 2026, 14 days before disclosure).
The latest release, 4.0.9, is not affected.
50% of @fastify/express downloads last week were affected versions (62.8K).