Vulnerability · Published Feb 27, 2026 · Assigned by openjs
CVE-2026-2880@fastify/middie has an improper path normalization vulnerability
High 8.2
In plain English
A high-severity improper input validation in @fastify/middie from @fastify/middie. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)). When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @fastify/middie | 9.2.0 | GHSA-8p85-9qpw-fwgw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| @fastify/middie | @fastify/middie | 0.0.0 – before 9.2.0 |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N