CVE-2026-33804 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
Attackers can bypass middleware authentication checks by exploiting duplicate slash handling in deprecated configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33804?
CVE-2026-33804 is a high-severity authentication bypass vulnerability in @fastify/middie, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.
Weakness: CWE-436
Which versions are affected by CVE-2026-33804?
2 open source packages ship an affected version, including @fastify/middie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@fastify/middie npm | All versions | 9.3.2 |
@fastify/middie npm | All versions | 9.3.2 |
Products include Fastify Fastify\/Middie.
How do I fix CVE-2026-33804?
Upgrade @fastify/middie to 9.3.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-33804 being exploited?
There is no known exploitation of CVE-2026-33804 in the wild and no public exploit code.
Other vulnerabilities in @fastify/middie
- CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
- CVE-2026-14198 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values
- CVE-2026-6270 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
- CVE-2026-22031 Fastify Middie Middleware Path Bypass
- CVE-2026-2880 @fastify/middie has an improper path normalization vulnerability
Sources
Also known as GHSA-v9ww-2j6r-98q6.