CVE-2026-33804 Details
Description
@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.
A middleware bypass vulnerability has been identified in @fastify/middie versions through 9.3.1. This issue arises when the deprecated top-level ignoreDuplicateSlashes option is enabled, as the middleware path matching logic fails to account for duplicate slash normalization performed by Fastify's router. Consequently, requests containing duplicate slashes can bypass authentication and authorization checks. This vulnerability only affects applications using the deprecated top-level configuration style.
Users are advised to upgrade to @fastify/middie version 9.3.2 or later. Additionally, migrate from the deprecated top-level ignoreDuplicateSlashes option to routerOptions: { ignoreDuplicateSlashes: true }.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/fastify/middie/security/advisories/GHSA-v9ww-2j6r-98q6 | openjs | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | openjs |
Affected Products
| Product | Versions |
|---|---|
| fastify fastify/middie | < 9.3.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | CPE Deprecation Remap | [email protected] |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 16, 2026 | New CVE Received | openjs |