Executive Summary

This vulnerability exists in the @fastify/express plugin before version 4.0.3, where middleware registered with a specific path prefix can be bypassed by using URL-encoded characters in the path (e.g., '/%61dmin' instead of '/admin'). The middleware engine fails to decode and match the encoded path, so it skips executing the middleware, but the underlying Fastify router correctly decodes the path and matches the route handler. This allows attackers to access protected endpoints without the middleware constraints, effectively bypassing protections like authentication or access controls. [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to bypass middleware protections such as authentication or access controls by using URL-encoded paths. As a result, attackers can gain unauthorized access to protected endpoints, leading to high confidentiality and integrity loss. The availability impact is low, but the unauthorized access can expose sensitive data or allow unauthorized actions within the application. [2]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by testing if middleware protections on your Fastify application using @fastify/express are bypassed when accessing URL-encoded paths. For example, if you have middleware protecting the path '/admin', try accessing '/%61dmin' (where '%61' is the URL-encoded 'a'). If the middleware is bypassed and the route handler responds normally, your system is vulnerable. A practical test command using curl would be: curl -i http://yourserver/%61dmin and compare it to curl -i http://yourserver/admin to see if middleware is enforced differently. [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to upgrade the @fastify/express package to version 4.0.3 or later, where the vulnerability is patched. The fix involves decoding URL paths before middleware matching to prevent bypass via URL-encoded characters. Applying this update ensures middleware protections correctly match encoded paths and block unauthorized access. [1, 2]

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to bypass middleware protections and access protected endpoints without proper authentication or access controls, leading to high confidentiality and integrity loss. Such unauthorized access to sensitive data or systems can result in non-compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information. [2]

Useful 0 Not Useful 0