CVE-2026-6556— Fastify 授权问题漏洞

@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authentication, authorization, rate limiting, or auditing on routes inside a prefixed scope can be bypassed by sending a request to the prefixed route, because Fastify still matches the route but the middleware is skipped. Patches: upgrade to @fastify/express 4.0.7. Workarounds: use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

授权机制不恰当

Fastify 授权问题漏洞

Fastify是Fastify团队开源的一个 Web 框架。 Fastify 4.0.6及之前版本存在授权问题漏洞，该漏洞源于在带前缀的插件作用域中，非字符串挂载路径（路径数组和正则表达式）无法得到前缀重写，导致路径作用域中间件被绕过，可能影响认证、授权、限流或审计功能。

N/A

N/A