Incorrect Behavior Order Affecting @fastify/express package, versions <4.0.7

@fastify/express is an Express compatibility layer for Fastify

Affected versions of this package are vulnerable to Incorrect Behavior Order due to incorrect mount path prefix rewriting in the use() middleware handling. An attacker can reach protected routes without the intended middleware by sending requests under a prefixed plugin where use() was registered with an array of paths or a RegExp path. In affected prefixed plugins, middleware paths were not consistently rewritten to include the Fastify prefix, so route-specific checks, such as authentication or blocking logic, did not run on the prefixed endpoint. This allows unauthenticated requests to reach handlers that were meant to be guarded, exposing protected data or functionality.

Notes

• Path-scoped middleware inside a prefixed Fastify plugin is only vulnerable when use() is given a non-string mount path such as an array or RegExp.
• The impact is limited to setups that rely on Express middleware for route protection inside the prefixed plugin.

Workarounds

• Use string mount paths in prefixed plugins instead of arrays or RegExp paths.
• Register separate use() calls for each path, for example admin.use('/private', authMiddleware) and admin.use('/settings', authMiddleware) instead of admin.use(['/private', '/settings'], authMiddleware).

• GitHub Commit
• Maintainer's Advisory