CVE-2026-33804CWE-436

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

High · published April 16, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00491 · 41.2th percentile
Weakness
CWE-436 · Interpretation Conflict
Published
2026-04-16T13:56Z
EPSS history
Timeline
  • 16 APR 13:56Z
    @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
    cvelistv5