Fastify Express Plugin Prefix Bypass in Path-Scoped Middleware

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authentication, authorization, rate limiting, or auditing on routes inside a prefixed scope can be bypassed by sending a request to the prefixed route, because Fastify still matches the route but the middleware is skipped. Patches: upgrade to @fastify/express 4.0.7. Workarounds: use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-6556 is a critical vulnerability in @fastify/express versions 4.0.6 and earlier that allows attackers to bypass path-scoped middleware protections. When middleware is registered using non-string mount paths (arrays or regular expressions) within a prefixed plugin scope, the prefix is not applied to these middleware rules, causing them to fail to match the actual prefixed request paths. This vulnerability directly undermines security controls like authentication, authorization, rate limiting, and auditing—creating a severe exposure for applications relying on these protections. Any organization using affected versions of @fastify/express with path-based middleware security controls is at risk of complete security control circumvention.

Casky.ai's 283 mapped skills leverage Claude AI with extended reasoning to detect the attack patterns behind this vulnerability across MITRE ATT&CK Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. Practitioners would see findings flagging CWE-285 (Improper Authorization) detections when middleware configuration analysis reveals non-string path definitions that lack proper prefix rewriting, or when request routing logs show authenticated/rate-limited paths being accessed without triggering expected security controls. The extended reasoning capabilities identify the subtle configuration mismatch between declared security boundaries and actual request routing logic, catching exploitation attempts where attackers craft requests that bypass unprefixed regex or array-based middleware rules to access protected resources or escalate privileges.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-6556.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-6556

Casky has 283 skills that investigate the attack patterns behind CVE-2026-6556. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn