CVE-2026-22037

CVE-2026-22037 affects the @fastify/express plugin prior to version 4.0.3, allowing attackers to bypass middleware by using URL-encoded characters in path prefixes. This high-severity vulnerability (CVSS 8.4) permits unauthorized access to protected endpoints, as the middleware engine fails to match encoded paths while the Fastify router correctly decodes and processes them, leading to potential compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.