Middleware Bypass Vulnerability in @fastify/middie by Fastify

CVE-2026-33804

What is CVE-2026-33804?

The middleware bypass in @fastify/middie occurs when applications enable the deprecated ignoreDuplicateSlashes option. In this case, the middleware path matching logic fails to adequately address duplicate slash normalization in Fastify's router. This flaw allows requests with duplicate slashes to evade middleware authentication and authorization checks entirely, putting applications leveraging this configuration at risk. It is critical to upgrade to version 9.3.2 or later of @fastify/middie to resolve this issue. As a temporary measure, disabling the ignoreDuplicateSlashes option is necessary for immediate protection.

References