CVE-2026-6556: @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

Synopsis

An authentication bypass vulnerability exists in @fastify/express versions 4.0.6 and earlier. The flaw is reachable over the network without any credentials, because @fastify/express fails to rewrite non-string middleware mount paths (arrays and regular expressions) when used inside prefixed plugin scopes, causing security middleware such as authentication, authorization, rate limiting, and auditing layers to be silently skipped while Fastify continues routing the request normally. Successful exploitation allows an unauthenticated remote attacker to read protected resources and tamper with data that the bypassed middleware was meant to guard. A patched-image rebuild at version 4.0.7 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends a crafted HTTP request to the prefixed route without any prior foothold on the host.

• AuthenticationNot required

  No credentials are needed; the bypass works precisely because the middleware responsible for enforcing authentication is skipped before any identity check occurs.

• Victim interactionNot required

  No user action or social engineering is required; the attacker sends the request directly and the bypass takes effect immediately.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker only needs to know a prefixed route path, and no race conditions or special memory layout are involved.

Blast Radius

• Reads data from routes protected by the bypassed middleware, including session tokens, user records, or any resource the authorization layer was meant to restrict.
• Modifies or writes data on prefixed routes where the bypassed middleware enforced write authorization or input validation controls.
• Bypasses rate-limiting middleware, enabling high-volume scraping or brute-force attempts against otherwise throttled endpoints.
• Evades auditing and logging middleware, leaving no trace in audit logs for actions taken on affected routes.