CVE-2026-33804

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33804
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33804.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33804
Aliases
Downstream
Published
2026-04-16T13:56:56Z
Modified
2026-08-12T03:51:26Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option
Details

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.

Database specific 
{
    "cna_assigner": "openjs",
    "cwe_ids": [
        "CWE-436"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33804.json"
}
References

Affected packages

Git / github.com/fastify/middie

Affected ranges

Type
GIT
Repo
https://github.com/fastify/middie
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
792d2f46ae68516d3122c9a4468a5748a34efb47
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:fastify:fastify\\/middie:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.3.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v0.*
v0.2.0
v0.3.0
v1.*
v1.0.0
v1.1.0
v2.*
v2.0.0
v2.1.0
v2.1.1
v3.*
v3.0.0
v3.1.0
v3.2.0
v3.2.1
v4.*
v4.0.0
v4.0.1
v4.1.0
v5.*
v5.0.0
v5.1.0
v5.2.0
v5.3.0
v5.4.0
v6.*
v6.0.0
v7.*
v7.0.0
v8.*
v8.0.0
v8.1.0
v8.2.0
v8.3.0
v8.3.1
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.1.0
v9.2.0
v9.3.0
v9.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33804.json"