@fastify/express versions up to 4.0.4 contain a vulnerability (CWE-436) in the onRegister function where middleware paths are incorrectly prefixed twice if a child plugin is registered with a prefix matching the middleware path. This causes the middleware to fail to match requests, effectively bypassing security controls implemented via Express middleware. The vulnerability has a CVSS 3.1 score of 9.1 (critical) due to its network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. The vendor has released version 4.0.5 to address this issue.

Exploitation of this vulnerability allows attackers to bypass all Express middleware security controls—including authentication, authorization, and rate limiting—on routes defined within affected child plugin scopes. This can lead to unauthorized access and manipulation of protected resources. There is no need for special request crafting or configuration to exploit this issue, increasing its risk. No known exploits in the wild have been reported at this time.

Upgrade to @fastify/express version 4.0.5 or later where this path handling bug is fixed. Patch status is not explicitly stated in the vendor advisory, but the description clearly states upgrading resolves the issue. No other mitigations are indicated or required.