CVE-2026-2880

The record

A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)). When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.

Affected packages

Related vulnerabilities

• GHSA-8p85-9qpw-fwgw @fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware Same vulnerability
• GHSA-72c6-fx6q-fr5w @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes Also affects @fastify/middie
• GHSA-v9ww-2j6r-98q6 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes… Also affects @fastify/middie
• CVE-2026-33804 @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the… Also affects @fastify/middie
• CVE-2026-6270 @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly… Also affects @fastify/middie
• GHSA-cxrg-g7r8-w69p Fastify Middie Middleware Path Bypass Also affects @fastify/middie
• CVE-2026-22031 @fastify/middie is the plugin that adds middleware support on steroids to Fastify. Also affects @fastify/middie
• CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20