DNA View

High Severity Vulnerability

This vulnerability has been rated as High severity. Immediate action is recommended.

CVE-2026-33804

High

Low Medium High Critical

7.4

CVSS Score

Published: Apr 16, 2026

Last Modified: Apr 22, 2026

CWE: CWE-436

Vulnerability Description

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

References & Resources

Severity Details

7.4

out of 10.0

High

Weakness Type (CWE)

CWE-436

Interpretation Conflict

Description: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Typical Severity: Medium
Abstraction Level: Class