The vulnerability allows an attacker to bypass middleware authentication and authorization checks by sending requests that contain duplicate slashes, exploiting a mismatch between Fastify’s router normalisation and the middleware path matching logic when the deprecated ignoreDuplicateSlashes option is enabled. This can allow unauthorised access to protected resources or API endpoints.

The affected component is the @fastify/middie library, versions 9.3.1 and earlier. Applications that include these versions and enable the ignoreDuplicateSlashes configuration option are vulnerable. The issue does not exist in @fastify/middie 9.3.2 or later, nor in applications that do not use the deprecated option.

With a CVSS score of 7.4, the vulnerability is considered high‑medium risk. No EPSS data is available, and it is not listed in the CISA known exploited vulnerabilities catalog. The attack vector is local to the web application context and requires an attacker to craft a URL containing duplicate slashes; the patch is only effective when the ignoreDuplicateSlashes option is enabled. If the option is disabled, the vulnerability cannot be exploited.