https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:04:16 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-05651 bdu:2026-05651 https://cve.radiocsirt.org/vuln/bdu:2026-05651 https://cve.radiocsirt.org/vuln/euvd-2026-291385 EUVD-2026-291385 https://cve.radiocsirt.org/vuln/euvd-2026-291385 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33807 <p>@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match incoming requests. This results in complete bypass of Express middleware security controls, including authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. No special configuration or request crafting is required.</p> <p>Upgrade to @fastify/express v4.0.5 or later.</p> <p>@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match incoming requests. This results in complete bypass of Express middleware security controls, including authentication, authorization, and rate limiting, for all routes defined within affected child plugin scopes. No special configuration or request crafting is required.</p> <p>Upgrade to @fastify/express v4.0.5 or later.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33807 https://cve.radiocsirt.org/vuln/ghsa-hrwm-hgmj-7p9c <p><strong>Affected:</strong> npm: @fastify/express</p> <p>### Summary</p> <p>`@fastify/express` v4.0.4 contains a path handling bug in the `onRegister` function that causes middleware paths to be doubled when inherited by child plugins. This results in complete bypass of Express middleware security controls for all routes defined within child plugin scopes that share a prefix with parent-scoped middleware. No special configuration is required — this affects the default Fastify configuration.</p> <p>### Details</p> <p>The vulnerability exists in the `onRegister` function at `index.js` lines 92-101. When a child plugin is registered with a prefix, the `onRegister` hook copies middleware from the parent scope and re-registers it using `instance.use(...middleware)`. However, the middleware paths stored in `kMiddlewares` are already prefixed from their original registration.</p> <p>The call flow demonstrates the problem: 1. Parent scope registers middleware: `app.use(&#39;/admin&#39;, authFn)` — `use()` calculates path as `&#39;&#39; + &#39;/admin&#39; = &#39;/admin&#39;` — stores `[&#39;/admin&#39;, authFn]` in `kMiddlewares` 2. Child plugin registers with `{ prefix: &#39;/admin&#39; }` — triggers `onRegister(instance)` 3. `onRegister` copies parent middleware and calls `instance.use(&#39;/admin&#39;, authFn)` on child 4. Child&#39;s `use()` function calculates path as `&#39;/admin&#39; + &#39;/admin&#39; = &#39;/admin/admin&#39;` — registers middleware with doubled path 5. Routes in child scope use the child&#39;s Express instance, where middleware is registered under the incorrect path `/admin/admin` 6. Requests to `/admin/secret` don&#39;t match…</p> <p><strong>Affected:</strong> npm: @fastify/express</p> <p>### Summary</p> <p>`@fastify/express` v4.0.4 contains a path handling bug in the `onRegister` function that causes middleware paths to be doubled when inherited by child plugins. This results in complete bypass of Express middleware security controls for all routes defined within child plugin scopes that share a prefix with parent-scoped middleware. No special configuration is required — this affects the default Fastify configuration.</p> <p>### Details</p> <p>The vulnerability exists in the `onRegister` function at `index.js` lines 92-101. When a child plugin is registered with a prefix, the `onRegister` hook copies middleware from the parent scope and re-registers it using `instance.use(...middleware)`. However, the middleware paths stored in `kMiddlewares` are already prefixed from their original registration.</p> <p>The call flow demonstrates the problem: 1. Parent scope registers middleware: `app.use(&#39;/admin&#39;, authFn)` — `use()` calculates path as `&#39;&#39; + &#39;/admin&#39; = &#39;/admin&#39;` — stores `[&#39;/admin&#39;, authFn]` in `kMiddlewares` 2. Child plugin registers with `{ prefix: &#39;/admin&#39; }` — triggers `onRegister(instance)` 3. `onRegister` copies parent middleware and calls `instance.use(&#39;/admin&#39;, authFn)` on child 4. Child&#39;s `use()` function calculates path as `&#39;/admin&#39; + &#39;/admin&#39; = &#39;/admin/admin&#39;` — registers middleware with doubled path 5. Routes in child scope use the child&#39;s Express instance, where middleware is registered under the incorrect path `/admin/admin` 6. Requests to `/admin/secret` don&#39;t match…</p> https://cve.radiocsirt.org/vuln/ghsa-hrwm-hgmj-7p9c