CVE-2026-33807

{"id": "CVE-2026-33807", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33807", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T13:09:41.621709Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "affectedData": [{"vendor": "fastify", "product": "@fastify/express", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.5", "versionType": "semver"}, {"status": "unaffected", "version": "4.0.5", "versionType": "semver"}], "packageURL": "pkg:npm/@fastify/express", "defaultStatus": "unaffected"}]}], "published": "2026-04-15T10:16:48.310", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-436"}]}], "descriptions": [{"lang": "en", "value": "@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match incoming requests. This results in complete bypass of Express middleware security controls, including authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. No special configuration or request crafting is required.\n\nUpgrade to @fastify/express v4.0.5 or later."}, {"lang": "es", "value": "@fastify/express v4.0.4 y anteriores contiene un error de manejo de rutas en la funci\u00f3n onRegister que provoca que las rutas de middleware se dupliquen cuando son heredadas por plugins hijos. Cuando un plugin hijo se registra con un prefijo que coincide con una ruta de middleware, la ruta de middleware se prefija una segunda vez, lo que provoca que nunca coincida con las solicitudes entrantes. Esto resulta en una omisi\u00f3n completa de los controles de seguridad de middleware de Express, incluyendo autenticaci\u00f3n, autorizaci\u00f3n y limitaci\u00f3n de velocidad, para todas las rutas definidas dentro de los \u00e1mbitos de los plugins hijos afectados. No se requiere configuraci\u00f3n especial ni elaboraci\u00f3n de solicitudes.\n\nActualice a @fastify/express v4.0.5 o posterior."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify\\/express:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FD8C629A-73A6-46F2-BA53-823A9CE66738", "versionEndExcluding": "4.0.5"}], "operator": "OR"}]}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}