{"cve":"CVE-2026-33804","nvd":{"published":"2026-04-16T15:17:34.633","modified":"2026-06-17T10:38:07.300","status":"Analyzed","description":"@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-436"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/middie/security/advisories/GHSA-v9ww-2j6r-98q6"],"products":["fastify:fastify\\/middie"],"source":"nvd","synced_at":"2026-10-19T22:30:49.762551342+00:00"},"epss":{"cve":"CVE-2026-33804","score":0.00278,"percentile":0.20263,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v9ww-2j6r-98q6","url":"https://osv.dev/vulnerability/GHSA-v9ww-2j6r-98q6","summary":"@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option","modified":"2026-04-16T22:56:28.833804Z","packages":[{"ecosystem":"npm","name":"@fastify/middie","purl":"pkg:npm/%40fastify/middie","ranges":["<9.3.2"],"fixed":["9.3.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}