SecuriTricks - CVE-2026-33804

Description

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.

Product(s) Impacted

Vendor	Product	Versions
Fastify	Middie	9.3.1, <9.3.2

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-436

Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	fastify	middie	9.3.1	/	/	/	/	/	/	/
a	fastify	middie	<9.3.2	/	/	/	/	/	/	/

References

https://cna.openjsf.org/security-advisories.html

https://github.com/fastify/middie/security/advisories/GHSA-v9ww-2j6r-98q6

CVSS Score

7.4 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

View Vector String

Timeline

Published: April 16, 2026, 3:17 p.m.
Last Modified: April 17, 2026, 3:17 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

ce714d77-add3-4f53-aff5-83d477b104bb

CVE-2026-33804