@fastify/express
4.0.8 · 4 Oct 2026MIT38.5k / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @fastify/express. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 4.0.8 | Safe from 4.0.5 | |
| 3.0.0 | 9 open advisories, worst critical · last release Apr 2024, no longer updated |
- Critical@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)GHSA-6hw5-45gm-fj88 · 16 Apr 2026
- 4.x4.0.0 – 4.0.4Fixed in 4.0.5
- 3.x and older1.0.0 – 3.0.0No fix, no longer updated · move to 4.0.5
- Critical@fastify/express's middleware path doubling causes authentication bypass in child plugin scopesGHSA-hrwm-hgmj-7p9c · 16 Apr 2026
- 4.x4.0.0 – 4.0.4Fixed in 4.0.5
- 3.x and older1.0.0 – 3.0.0No fix, no longer updated · move to 4.0.5
- High@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)GHSA-g6q3-96cp-5r5m · 20 Jan 2026
- 4.x4.0.0 – 4.0.2Fixed in 4.0.3
- 3.x and older1.0.0 – 3.0.0No fix, no longer updated · move to 4.0.3
Registry facts last checked 23 Oct 2026. Releases and advisories last read 23 Oct 2026.