CVE-2026-33808 is an authentication bypass in @fastify/express 4.0.4 and earlier. NVD scores it 9.1. Fastify normalizes a URL and finds the route, but the plugin hands Express the original URL, so path scoped middleware does not match. Upgrade to 4.0.5. It is distinct from the earlier percent encoding bypass in CVE-2026-22037.
What's affected
Versions up to 4.0.4 are affected and 4.0.5 is the patched version. Two settings create exposure: ignoreDuplicateSlashes, which allows a URL with doubled leading slashes, and useSemicolonDelimiter, which allows a semicolon in the path. Apps that enable neither are not in the described path. The advisory says it is distinct from CVE-2026-22037, a percent encoding bypass fixed in 4.0.3.
How to check if you're exposed
npm ls @fastify/express
grep -rn "ignoreDuplicateSlashes\|useSemicolonDelimiter" src/
Then list your Express middleware mounted with a path prefix such as an admin area, since those are the checks that could be skipped.
What to do now
- Upgrade
@fastify/expressto 4.0.5 or later. - Until then, disable
ignoreDuplicateSlashesanduseSemicolonDelimiterif you can. This is our suggestion, not an advisory workaround. - Test protected routes with duplicate slashes and semicolons after upgrading.
- Add authentication inside route handlers for sensitive routes.
Why it matters
The record uses CWE-436, interpretation conflict. The router and the middleware layer disagreed about what path a request asked for. Authentication that depends on prefix matching fails open when the two disagree. It is a pattern that recurs across web stacks, so a check that lives with the handler is safer than one in a separate layer. The record is not marked as exploited in the wild and is not in CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
You can also paste your lockfile into the free scan at gold.safeguard.sh/scan to see whether this package is in your tree.
Quick check
Do I need both options enabled?
No. Either duplicate slash handling or semicolon handling is enough for the bypass described.
Sources
Last reviewed: 19 October 2026.
