CVE-2026-2880

@fastify/middie has an improper path normalization vulnerability

Published Feb 27, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Description

A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)).

When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.

Analysis

Technical impact

The vulnerability is an improper path normalization flaw in @fastify/middie that allows crafted request paths to bypass authentication and authorization checks when path‑scoped middleware is used. Attackers can request a protected path such as '/secret' while the middleware is skipped, giving them unintended access. The weakness is classified as CWE‑20, which reflects improper input validation.

Affected Systems

Affected versions are all releases of @fastify/middie earlier than 9.2.0. The product is maintained by OpenJSF and is used by applications built on the Fastify framework. Any deployment that relies on path‑scoped middleware with router normalization enabled is susceptible.

Risk and Exploitability

The flaw has a CVSS score of 8.2, indicating high severity, but the EPSS score is less than 1% so exploitation is still considered unlikely at present. It is not listed in CISA's Known Exploited Vulnerabilities catalog. The attack vector requires an HTTP client that can control the request path; if router normalization options such as ignoreDuplicateSlashes or useSemicolonDelimiter are enabled, a crafted URL can trick the router into handling the request without executing the middleware.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

@fastify/middie

unaffected

Version	Status	Constraints
`0.0.0`	affected	< 9.2.0

Configuration 1 [-]

cpe:2.3:a:fastify:fastify\/middie:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Fastify

Middie

Version	Status	Scheme	Platform
`[0.0.0,9.2.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to @fastify/middie 9.2.0 or newer.
Disable or remove router normalization features (ignoreDuplicateSlashes, useSemicolonDelimiter, trailing slash handling) that allow path mangling until the upgrade is applied.
If the application requires these features, add additional authentication checks at the route handler level or avoid using path‑scoped middleware for protected resources.

Generated by OpenCVE AI on April 17, 2026 at 13:56 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-8p85-9qpw-fwgw	@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.430% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/fastify/middie/security/advisories/GHSA-8p85-9qpw-fwgw

History

May 14, 2026 3:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Fastify fastify\/middie
CPEs	cpe:2.3:a:openjsf:\@fastify\/middie::::::fastify::*	cpe:2.3:a:fastify:fastify\/middie::::::node.js::*
Vendors & Products	Openjsf Openjsf \@fastify\/middie	Fastify fastify\/middie

Mar 19, 2026 5:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Openjsf Openjsf \@fastify\/middie
CPEs		cpe:2.3:a:openjsf:\@fastify\/middie::::::fastify::*
Vendors & Products		Openjsf Openjsf \@fastify\/middie
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

Mar 2, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Fastify Fastify middie
Vendors & Products		Fastify Fastify middie

Feb 27, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 27, 2026 6:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)). When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.
Title		@fastify/middie has an improper path normalization vulnerability
Weaknesses		CWE-20
References		https://github.com/fastify/middie/security/advisories/GHSA-8p85-9qpw-fwgw
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}`