@fastify/middie CVE-2026-33804

Requires the target Fastify application to have the deprecated top-level ignoreDuplicateSlashes option enabled via fastify({ ignoreDuplicateSlashes: true }) AND to enforce access control through @fastify/middie <= 9.3.1 middleware bound to specific paths. The concrete exploitation primitive is sending an HTTP request whose path contains duplicate leading slashes (e.g. //admin/secret) so the Fastify router normalizes it while middie does not. Limiting factors: the deprecated option is off by default and not present in typical modern configs; applications that instead use routerOptions: { ignoreDuplicateSlashes: true } are entirely unaffected; and exploitation only yields access to resources that were protected purely by middie-layer middleware rather than route-level or handler-level checks. No authentication or user interaction is required (PR:N/UI:N) once the vulnerable configuration is present.

Signals are mixed and point to a real-but-conditional issue rather than a mass-exploitation event. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N, 7.4 High) captures the key trade-off: exploitation is network-based and unauthenticated, but AC:H reflects the required non-default precondition (the deprecated top-level option must be enabled). EPSS is very low (0.04%, 12th percentile) and SSVC records Exploitation: none and Automatable: no, consistent with no KEV listing and no public PoC - this is not currently seen being exploited. However, SSVC Technical Impact is total, matching the C:H/I:H bypass of authentication/authorization. The dominant limiting factor is configuration: applications using routerOptions: { ignoreDuplicateSlashes: true } (the recommended form) are not affected at all, and the option is off by default. Net: prioritize patching where the deprecated option is in use, but this is not an untargeted internet-wide emergency. No conflicting data between the CVSS network vector and the description was found; both agree it is remotely reachable when the specific config is present.

An attacker targets a Fastify application that gates /admin/* behind authentication middleware registered through @fastify/middie and that was started with the deprecated fastify({ ignoreDuplicateSlashes: true }) option. The attacker simply requests //admin/secret: Fastify's router normalizes the path and serves the protected handler, while middie fails to match its auth middleware to the un-normalized path, returning the protected content without credentials. No PoC is publicly identified, but the technique is trivial to reproduce given the low complexity of the request itself.