Packages / @fastify/middie / Security

HighVulnerabilityGHSA-v9ww-2j6r-98q6CVE-2026-33804Published 16 Apr 2026

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

Affected releases · @fastify/middie

  • 9.x9.0.0 – 9.3.1Fixed in 9.3.2
  • 8.x8.0.0 – 8.3.3No fix on this line yet

On 9.x, the newest line:

npm install @fastify/middie@9.3.2
9.x

  1. Affected

    9.0.0 – 9.3.1

    8 releases

  2. Fixed

    9.3.2 – 9.3.6

    5 releases, latest

8.x

  1. Affected

    8.0.0 – 8.3.3

    7 releases

20 stable releases of @fastify/middie, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @fastify/middie. It is read in your browser and sent nowhere.

What happens

Impact

@fastify/middie v9.3.1 and earlier does not read the deprecated (but still functional) top-level ignoreDuplicateSlashes option, only reading from routerOptions. This creates a normalization gap: Fastify's router normalizes duplicate slashes but middie does not, allowing middleware bypass via URLs with duplicate leading slashes (e.g., //admin/secret).

This only affects applications using the deprecated top-level configuration style (fastify({ ignoreDuplicateSlashes: true })). Applications using routerOptions: { ignoreDuplicateSlashes: true } are not affected.

This is distinct from GHSA-8p85-9qpw-fwgw (CVE-2026-2880), which was patched in v9.2.0.

Patches

Upgrade to @fastify/middie >= 9.3.2.

Workarounds

Migrate from deprecated top-level ignoreDuplicateSlashes: true to routerOptions: { ignoreDuplicateSlashes: true }.