Authentication Bypass in @fastify/express Middleware Path Inheritance

CVE-2026-33807 is a path handling vulnerability in @fastify/express affecting version 4.0.4 and earlier. In the plugin registration logic, specifically the onRegister path inheritance behavior, middleware paths inherited by child plugins can be prefixed twice. When a child plugin is registered with a prefix that matches or overlaps a middleware path defined in a parent scope, the middleware path is incorrectly doubled, causing it to no longer match incoming requests. As a result, Express middleware registered through @fastify/express may silently never execute for routes within affected child plugin scopes. The issue can bypass middleware-enforced security controls such as authentication, authorization, and rate limiting.