CVE-2026-6556: Fastify @fastify/express Path-Scoped Middleware Bypass via Non-String Mount Paths
Versions of @fastify/express up to 4.0.6 fail to apply the plugin prefix to middleware mount paths given as arrays or regular expressions. Middleware scoped to routes inside prefixed plugins can therefore be skipped, which the record describes as a bypass of authentication, authorization, rate limiting or auditing controls. The record points to version 4.0.7 as the patched release and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-6556 affects the @fastify/express package. According to the record, versions 4.0.6 and earlier only add the plugin prefix to middleware mount paths when the path is a string. Mount paths given as arrays or regular expressions are left unprefixed inside prefixed plugin scopes, so the middleware does not match the real prefixed request path.
Impact
The record states that applications using path-scoped middleware for authentication, authorization, rate limiting or auditing on routes inside a prefixed scope can be bypassed, because the route is still matched while the middleware is skipped. The CWE classification is CWE-285 (Improper Authorization). The record reports a CVSS 3.1 base score of 9.1 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, attributed to the CNA.
Affected products and versions
- Product listed in the record: Fastify Fastify/express
- Affected range listed in the record: versions before 4.0.7
- Fixed version named in the record: 4.0.7
Exploitation status
The CISA KEV catalog entry in the record is not listed. The sources consulted show no confirmed active exploitation or exploitation in the wild for this CVE. The record does not provide further exploitation data.
Remediation and mitigation
- Upgrade @fastify/express to version 4.0.7, as stated in the record and in the linked GitHub Security Advisory.
- If upgrading is not immediately possible, the record suggests using string mount paths instead of arrays or regular expressions inside prefixed plugins, or registering one use call per path.
- Review every prefixed plugin that relies on path-scoped middleware for security controls and confirm the controls run on the real prefixed routes.
Detection guidance
- Inventory projects that use @fastify/express and record the installed version.
- Review middleware registrations inside prefixed plugins, especially those that use arrays or regular expressions as mount paths.
- In test environments, verify that authentication, authorization, rate limiting and audit middleware execute for prefixed routes, and watch for routes that serve responses without the expected middleware effects.
Limitations of the available information
The record does not describe the exact conditions of an attack, the full list of affected routes, or any vendor-published timeline beyond the fix reference. The EPSS data in the record is a statistical estimate and does not confirm exploitation. Where the record is silent, this analysis does not assume additional details.
Frequently asked questions
What is the core problem in CVE-2026-6556?
According to the record, @fastify/express up to 4.0.6 applies the plugin prefix to middleware mount paths only when they are strings. Arrays and regular expressions are left unprefixed, so middleware scoped with them may not run for prefixed routes.
Which version fixes the issue?
The record names @fastify/express 4.0.7 as the patched version and links to the GitHub Security Advisory GHSA-3wf5-7852-vcfq as a mitigation reference.
Is this vulnerability known to be actively exploited?
No. The CVE is not listed in the CISA KEV catalog in the record, and the sources consulted show no confirmed active exploitation.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.