CVE-2026-2880
published 2026-02-27CVE-2026-2880: A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example…
PriorityP260critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.39%
30.8th percentile
A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)).
When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fastify | express | >= 0 < 4.0.5 | 4.0.5 |
| fastify | fastify_middie | < 9.2.0 | 9.2.0 |
| fastify | middie | >= 0 < 9.2.0 | 9.2.0 |
| fastify | middie | >= 0 < 9.3.2 | 9.3.2 |
| fastify | middie_fastify_middie | >= 0.0.0 < 9.2.0 | 9.2.0 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
ghsa·2026-04-16·CVSS 8.4
CVE-2026-33808 [HIGH] CWE-436 @fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
### Summary
`@fastify/express` v4.0.4 fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via two vectors:
1. **Duplicate slashes** (`//admin/dashboard`) when `ignoreDuplicateSlashes: true` is configured
2. **Semicolon delimiters** (`/admin;bypass`) when `useSemicolonDelimiter: true` is configured
In both cases, Fastify's router normalizes the URL and matches the route, but `@fastify/express` passes the original un-normalized URL to Express middleware, which fails to match and is skipped.
Note: This is distinct from GHSA-g6q3-96cp-5r
GHSA
@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
ghsa·2026-04-16·CVSS 8.2
CVE-2026-33804 [HIGH] CWE-436 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
### Impact
`@fastify/middie` v9.3.1 and earlier does not read the deprecated (but still functional) top-level `ignoreDuplicateSlashes` option, only reading from `routerOptions`. This creates a normalization gap: Fastify's router normalizes duplicate slashes but middie does not, allowing middleware bypass via URLs with duplicate leading slashes (e.g., `//admin/secret`).
This only affects applications using the deprecated top-level configuration style (`fastify({ ignoreDuplicateSlashes: true })`). Applications using `routerOptions: { ignoreDuplicateSlashes: true }` are not affected.
This is distinct from [GHSA-8p85-9qpw-fwgw](https://github.com/fastify/middie/security/advisories/GHSA-8p85-9qpw-fw
OSV
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
osv·2026-02-28
CVE-2026-2880 [HIGH] @fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
## Summary
A path normalization inconsistency in `@fastify/middie` can result in authentication/authorization bypass when using path-scoped middleware (for example, `app.use('/secret', auth)`).
When Fastify router normalization options are enabled (such as `ignoreDuplicateSlashes`, `useSemicolonDelimiter`, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.
## Impact
An unauthenticated remote attacker can access endpoints intended to be protected by middleware-based auth/authorization controls by sending specially crafted URL paths (for example, `//secret` or `/secret;foo=bar`), depending on router option configuration.
T
GHSA
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
ghsa·2026-02-28
CVE-2026-2880 [HIGH] CWE-20 @fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware
## Summary
A path normalization inconsistency in `@fastify/middie` can result in authentication/authorization bypass when using path-scoped middleware (for example, `app.use('/secret', auth)`).
When Fastify router normalization options are enabled (such as `ignoreDuplicateSlashes`, `useSemicolonDelimiter`, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.
## Impact
An unauthenticated remote attacker can access endpoints intended to be protected by middleware-based auth/authorization controls by sending specially crafted URL paths (for example, `//secret` or `/secret;foo=bar`), depending on router option configuration.
T
No detection rules found.
No public exploits indexed.
2026-02-27
Published