@fastify/middie CVE-2026-2880

Upgrade @fastify/middie to version 9.2.0 or later (npm update @fastify/middie) as released by vendor. Patch commit available at https://github.com/fastify/middie/commit/140e0dd0359d890fec7e6ea1dcc5134d6bd554d4 and vendor advisory at https://github.com/fastify/middie/security/advisories/GHSA-8p85-9qpw-fwgw. If immediate upgrade is not feasible, implement compensating controls: (1) Move authentication and authorization logic from path-scoped middie middleware (app.use('/prefix', auth)) to route-level Fastify hooks (onRequest, preHandler) which execute after router normalization, ensuring consistent path evaluation - trade-off is code refactoring effort but eliminates bypass vector entirely. (2) Disable Fastify router normalization options (ignoreDuplicateSlashes, useSemicolonDelimiter, trailing slash handling) if not operationally required - trade-off is potential breakage of existing API contracts that rely on path normalization tolerance. (3) Deploy additional perimeter controls like web application firewall rules to block URLs with duplicate slashes or semicolons targeting protected paths - trade-off is maintenance overhead and potential false positives. Vendor explicitly recommends against relying solely on path-scoped middie guards for security boundaries until patched.