Fastify Middie Bypass: Double Slashes, Double Trouble

A high-severity vulnerability, CVE-2026-33804, has been identified in @fastify/middie versions 9.3.1 and earlier. According to the National Vulnerability Database, this flaw allows for a middleware bypass when an application utilizes the deprecated Fastify ignoreDuplicateSlashes option. The core issue lies in a mismatch between the middleware’s path matching logic and Fastify’s router, which normalizes duplicate slashes.

Essentially, if a request contains duplicate slashes, Fastify’s router processes them differently than the middleware expects. This discrepancy can allow an attacker to craft a request that bypasses authentication and authorization checks implemented by the middleware. The National Vulnerability Database assigns this a CVSS score of 7.4 (High), underscoring the potential for unauthorized access or other malicious activities. It’s a classic case of an edge case in path handling leading to a security headache.

The fix, as reported by the National Vulnerability Database, is to upgrade to @fastify/middie version 9.3.2. For those unable to upgrade immediately, the only workaround is to disable the ignoreDuplicateSlashes option entirely. This isn’t just a minor glitch; it’s a critical logic error that could open up applications to serious compromise if not addressed promptly.