PT-2026-33323 · Npm · @Fastify/Middie

Climba03003 + 3 · Published 2026-04-16 · Updated 2026-04-17 · CVE-2026-33804

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions @fastify/middie versions prior to 9.3.2

Description A middleware bypass exists when the deprecated ignoreDuplicateSlashes option is enabled. The middleware path matching logic fails to account for duplicate slash normalization performed by the router, allowing requests with duplicate leading slashes (e.g., '//admin/secret') to bypass authentication and authorization checks. This issue specifically affects applications using the deprecated top-level configuration style fastify({ ignoreDuplicateSlashes: true }) rather than the routerOptions configuration.

Recommendations Upgrade to @fastify/middie version 9.3.2. As a temporary workaround, migrate from the deprecated top-level ignoreDuplicateSlashes: true configuration to routerOptions: { ignoreDuplicateSlashes: true } or disable the ignoreDuplicateSlashes option.

Fix

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2026-33804

GHSA-V9WW-2J6R-98Q6

Affected Products

@Fastify/Middie

References · 9

• https://github.com/fastify/middie/security/advisories/GHSA-v9ww-2j6r-98q6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v9ww-2j6r-98q6 · Vendor Advisory
• https://cna.openjsf.org/security-advisories.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33804 · Security Note
• https://github.com/fastify/middie · Note
• https://twitter.com/CVEnew/status/2045102676988272773 · Twitter Post
• https://twitter.com/infoflowcloud/status/2045105199979634762 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044858577744011716 · Twitter Post
• https://twitter.com/kom_256/status/2044778243740278952 · Twitter Post