CVE-2026-33804

What it actually does

@fastify/middie 9.3.1 and earlier can fail to apply middleware-based authentication or authorization when an application has Fastify's deprecated ignoreDuplicateSlashes option enabled. Fastify's router normalizes duplicate slashes in request paths, but middie's middleware path matching does not account for that normalization. As a result, a route that is ultimately handled as a protected path may be reached through a path containing duplicate slashes while the intended middleware chain is not executed. The flaw can allow unauthenticated remote access to protected application functionality and data when the vulnerable package version and configuration are both present.

Why it matters to the business

Applications that rely on @fastify/middie middleware to protect sensitive routes may expose restricted data or actions to unauthenticated users if duplicate slash normalization is enabled. The practical impact depends on which routes are protected by middleware, but consequences can include data exposure, unauthorized transactions, privilege bypass, and loss of trust in application access controls. The issue is not listed in CISA KEV, has no known exploit maturity, and has a low, flat EPSS score, which suggests lower broad exploitation likelihood; however, internet-facing APIs using this exact configuration should still be prioritized because successful exploitation can directly bypass authorization.

How an attack unfolds

An attacker first identifies a Fastify application that uses @fastify/middie for middleware-based access control and has duplicate slash normalization enabled through the deprecated ignoreDuplicateSlashes option. The attacker maps protected endpoints and then sends requests containing duplicate slashes in the path, such as inserting an extra slash before or within the protected route. Fastify's router normalizes the path and routes the request to the intended endpoint, but middie's path matching may evaluate the unnormalized path and fail to invoke the middleware that enforces authentication or authorization. If the route handler itself does not independently recheck authorization, the attacker receives the protected response or triggers the protected action without the expected middleware checks.

How to fix it

Upgrade @fastify/middie to version 9.3.2 or later. Because the provided fixed_versions field is empty but the advisory description explicitly states the fixed version, treat 9.3.2 as the minimum safe version. Also disable Fastify's deprecated ignoreDuplicateSlashes option wherever possible, because the advisory states there are no workarounds other than disabling that option. Review route handlers that rely exclusively on middleware for authorization and add defense-in-depth checks for sensitive operations. After upgrading, rebuild and redeploy applications, refresh lockfiles, and ensure all container images or serverless bundles include the corrected dependency version.

How to confirm the fix worked

Confirm that deployed dependency manifests and runtime artifacts no longer include @fastify/middie 9.3.1 or earlier and instead use 9.3.2 or later. Inspect application configuration to verify ignoreDuplicateSlashes is disabled or absent. Functionally test protected routes by sending unauthenticated requests to the canonical path and to duplicate-slash variants; both should be denied consistently. Include cases with duplicate slashes at the beginning of the path, between path segments, and before route parameters. Confirm middleware authentication and authorization logs are generated for both canonical and duplicate-slash request variants, or that requests are rejected before reaching protected handlers.

Typical attack path

1. Discover or suspect a Node.js Fastify application using @fastify/middie middleware.
2. Identify protected API paths, administrative paths, or application routes that normally require authentication or authorization.
3. Send unauthenticated requests to those paths and confirm they are normally blocked.
4. Repeat the requests with duplicate slashes in the URL path, such as // or /segment//resource.
5. Rely on Fastify router normalization to route the request to the intended handler while middie middleware matching misses the protected path.
6. Access sensitive data or perform restricted actions if the route handler depends solely on middleware for access control.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, reverse proxy logs, WAF logs, CDN logs, API gateway logs, and application authentication or authorization middleware logs. Look for requests to sensitive endpoints where the URL path contains duplicate slashes and the response was successful, especially 200, 201, 202, 204, 206, 301, 302, or 304, without a corresponding authentication success event or middleware authorization decision. Compare normalized and raw URL fields if both are logged; suspicious cases include a raw path with // that maps to a protected normalized route. Review application logs for protected handler execution without preceding middleware log entries. Pay particular attention to unauthenticated source IPs, unusual user agents, scripted traffic, repeated probing of path variants, and requests immediately preceded by denied requests to the canonical protected path. If route-level audit logging exists, verify whether privileged operations were performed by anonymous, missing, expired, or unexpected identities during duplicate-slash requests.

• @fastify/middie@9.3.1
• @fastify/middie@9.3.0
• @fastify/middie@9.2.
• @fastify/middie@9.1.
• @fastify/middie@9.0.
• "@fastify/middie"
• "ignoreDuplicateSlashes": true
• ignoreDuplicateSlashes: true
• ignoreDuplicateSlashes=true
• GET //
• POST //
• PUT //
• PATCH //
• DELETE //
• GET /admin//
• GET //admin
• POST /admin//
• POST //admin
• GET /api//
• GET //api
• POST /api//
• POST //api
• //login
• //auth
• //admin
• //api
• //graphql
• //users
• //account
• //settings
• //internal

What your security team should do

• Inventory Fastify applications and identify any use of @fastify/middie at version 9.3.1 or earlier.
• Prioritize internet-facing applications and APIs that enable ignoreDuplicateSlashes and rely on middie middleware for authentication or authorization.
• Upgrade @fastify/middie to 9.3.2 or later and redeploy affected services.
• Disable the deprecated ignoreDuplicateSlashes option unless there is a documented compatibility requirement.
• Add regression tests that verify duplicate-slash URL variants cannot bypass authentication or authorization.
• Search historical access logs for successful unauthenticated or anomalous requests containing duplicate slashes to protected routes.
• Review sensitive route handlers to ensure authorization is enforced as close to the protected operation as possible, not only through path-matched middleware.
• Because EPSS is low and there is no KEV listing, handle this as a targeted exposure risk rather than evidence of active mass exploitation, while still remediating promptly where the vulnerable configuration is present.