CVE-2026-2880 @fastify/middie has an improper path normalization vulnerability

What is CVE-2026-2880?

CVE-2026-2880 is a high-severity authentication bypass vulnerability in @fastify/middie, published on 27 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)).

When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.

Weakness: CWE-20

Which versions are affected by CVE-2026-2880?

2 open source packages ship an affected version, including @fastify/middie. It affects 1 product.

Products include Fastify Fastify\/Middie.

How do I fix CVE-2026-2880?

Upgrade @fastify/middie to 9.2.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-2880 being exploited?

There is no known exploitation of CVE-2026-2880 in the wild and no public exploit code.

Other vulnerabilities in @fastify/middie

• CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target Critical 9.1
• CVE-2026-14198 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values Critical 9.1
• CVE-2026-6270 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes Critical 9.1
• CVE-2026-22031 Fastify Middie Middleware Path Bypass High 8.4
• CVE-2026-14181 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8p85-9qpw-fwgw.