CVE-2026-33808

OVERVIEW CVE-2026-33808 is a URL normalization bypass vulnerability affecting @fastify/express versions 4.0.4 and earlier. When Fastify router normalization options are enabled (either ignoreDuplicateSlashes or useSemicolonDelimiter), the middleware fails to properly normalize URLs before passing them to Express authentication middleware, creating a mismatch between what Fastify routes and what Express middleware validate. SEVERITY The vulnerability allows unauthenticated attackers to bypass path-scoped authentication middleware through URL manipulation, such as adding duplicate slashes or semicolon delimiters. The attack has low complexity and requires no authentication or special privileges, as attackers can simply craft malicious URLs to access protected routes. The impact is significant, potentially allowing complete circumvention of access controls protecting sensitive application functionality. The FAUCET Risk Score of 52.0/100 indicates a moderate-to-high risk posture. EXPLOITATION STATUS This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows no indication of active exploitation in the wild. Community attention appears limited, as reflected in the low EPSS score of 0.0017, suggesting minimal real-world prevalence compared to other vulnerabilities. The availability of exploit code is not reported, though the straightforward nature of URL manipulation means exploitation would be relatively trivial for motivated attackers. Organizations running affected versions should prioritize upgrading to v4.0.5 or later.