@fastify/middie CVE-2026-2880

Requires Fastify applications using @fastify/middie for path-scoped middleware (app.use('/path', middleware)) AND Fastify router configured with at least one normalization option enabled: ignoreDuplicateSlashes (allows //path to match /path), useSemicolonDelimiter (treats semicolons as path delimiters), or trailing-slash normalization settings. Specifically affects deployments where authentication or authorization middleware is applied via path prefix matching rather than route-level hooks. Does NOT affect Fastify applications without @fastify/middie, or those using route-level security controls (onRequest/preHandler hooks), or those with all router normalization options disabled. Attack vector is network-based (AV:N) with low complexity (AC:L) against default @fastify/middie configurations when router normalization is enabled, but attack conditions are present (AT:P) due to specific deployment architecture requirement.

Real-world risk is CRITICAL for affected deployments. CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates network-exploitable attack with low complexity but present attack conditions (AT:P) and no authentication required. High integrity impact (VI:H) reflects unauthorized access to protected resources. Confirmed actively exploited per CISA KEV listing, demonstrating real-world weaponization. However, EPSS score of 0.17% (38th percentile) is notably low despite KEV status, suggesting targeted rather than widespread opportunistic exploitation - likely attackers are focusing on known deployments with public Fastify footprints. Attack conditions are specific: requires Fastify applications using BOTH path-scoped @fastify/middie middleware for auth/authz AND router normalization options enabled. This configuration subset explains the EPSS/KEV divergence. Not automatable at scale (requires reconnaissance to identify Fastify+middie deployments), but trivial to exploit once target is identified (simple path crafting). Priority is IMMEDIATE for organizations using @fastify/middie with path-based security controls, MEDIUM for Fastify users without middie, DEFER for non-Fastify environments.

Attacker identifies a Fastify application using @fastify/middie version <9.2.0 with path-scoped authentication middleware protecting /admin endpoints (app.use('/admin', authMiddleware)). Attacker crafts HTTP request with duplicated slashes (GET //admin/users) or semicolon delimiter (GET /admin;x=y/users). The @fastify/middie middleware evaluates the raw path and fails to match '/admin' prefix, skipping authentication. Fastify's find-my-way router then normalizes the path to /admin/users and successfully routes to the protected handler. Attacker gains unauthorized access to administrative functionality without credentials. Publicly available exploit code exists per GitHub security advisory and patch commit analysis.