CVE-2026-33807

{
  "id": "CVE-2026-33807",
  "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb",
  "published": "2026-04-15T10:16:48.310",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match incoming requests. This results in complete bypass of Express middleware security controls, including authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. No special configuration or request crafting is required.\n\nUpgrade to @fastify/express v4.0.5 or later."
    },
    {
      "lang": "es",
      "value": "@fastify/express v4.0.4 y anteriores contiene un error de manejo de rutas en la función onRegister que provoca que las rutas de middleware se dupliquen cuando son heredadas por plugins hijos. Cuando un plugin hijo se registra con un prefijo que coincide con una ruta de middleware, la ruta de middleware se prefija una segunda vez, lo que provoca que nunca coincida con las solicitudes entrantes. Esto resulta en una omisión completa de los controles de seguridad de middleware de Express, incluyendo autenticación, autorización y limitación de velocidad, para todas las rutas definidas dentro de los ámbitos de los plugins hijos afectados. No se requiere configuración especial ni elaboración de solicitudes.\n\nActualice a @fastify/express v4.0.5 o posterior."
    }
  ],
  "affected": [
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "affectedData": [
        {
          "vendor": "fastify",
          "product": "@fastify/express",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/@fastify/express",
          "versions": [
            {
              "version": "0",
              "lessThan": "4.0.5",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.0.5",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-15T13:09:41.621709Z",
          "id": "CVE-2026-33807",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-436"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fastify:fastify\\/express:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "4.0.5",
              "matchCriteriaId": "FD8C629A-73A6-46F2-BA53-823A9CE66738"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.openjsf.org/security-advisories.html",
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c",
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}