What is the CVSS score of CVE-2026-33804?

CVE-2026-33804 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of @fastify/middie are affected by CVE-2026-33804?

@fastify/middie versions 9.3.1 and earlier contain an authentication bypass vulnerability allowing unauthenticated attackers to access protected routes when the deprecated ignoreDuplicateSlashes…. A patch is available.

How to fix or mitigate CVE-2026-33804?

Within 24 hours, audit your deployment to identify all @fastify/middie instances at version 9.3.1 or earlier and verify whether the deprecated top-level ignoreDuplicateSlashes configuration option is active-only deployments with this setting enabled are vulnerable. Within 7 days, apply the vendor-released patch by upgrading to the fixed @fastify/middie version and redeploy to all affected production and staging environments. Within 30 days, review historical access logs for exploitation attempts using duplicate-slash URL paths (format: //admin/secret) from the period before patching to identify any successful unauthorized access to protected routes.

@fastify/middie CVE-2026-33804

EUVD-2026-23235 HIGH

Interpretation Conflict (CWE-436)

2026-04-16 openjs

GHSA-v9ww-2j6r-98q6

Authentication Bypass Fastify Middie

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Remote and unauthenticated (AV:N/PR:N/UI:N) but AC:H because the non-default deprecated ignoreDuplicateSlashes config is required; bypass exposes protected read/write routes (C:H/I:H), no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:38 vuln.today

Analysis Generated

Jul 24, 2026 - 07:38 vuln.today

Patch released

Apr 22, 2026 - 17:30 nvd

Patch available

Apr 16, 2026 - 15:01 EUVD

EUVD ID Assigned

Apr 16, 2026 - 15:00 euvd

EUVD-2026-23235

CVE Published

Apr 16, 2026 - 13:56 nvd

HIGH 7.4

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 npm packages depend on @fastify/middie (3 direct, 1 indirect)

Ecosystem-wide dependent count for version 9.3.2.

DescriptionCVE.org

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.

AnalysisAI

Authentication and authorization bypass in @fastify/middie 9.3.1 and earlier lets remote unauthenticated attackers reach protected routes by sending URLs with duplicate leading slashes (e.g. //admin/secret) when the deprecated top-level Fastify ignoreDuplicateSlashes option is enabled. Because middie reads the option only from routerOptions while Fastify's router still honors the top-level form, a normalization gap allows middleware-enforced checks to be skipped. There is no public exploit identified at time of analysis and EPSS is negligible (0.04%), but SSVC rates technical impact as total, reflecting a full auth-check bypass on affected deployments.

Technical ContextAI

The affected component is @fastify/middie, the Connect/Express-style middleware engine for the Fastify Node.js web framework, distributed on npm. Fastify normalizes request paths (collapsing duplicate slashes) when ignoreDuplicateSlashes is set, so the router matches a canonical path, but middie performs its own independent path matching to decide which middleware (including auth/authz gates) to run. The root cause is CWE-436 (Interpretation Conflict): middie reads ignoreDuplicateSlashes only from routerOptions and ignores the still-functional deprecated top-level fastify({ ignoreDuplicateSlashes: true }) form, so the router and the middleware layer disagree on what path is being requested. A request to //admin/secret is normalized by the router to /admin/secret and served, while middie sees the un-normalized //admin/secret and fails to apply the middleware bound to /admin/secret. This is distinct from the earlier GHSA-8p85-9qpw-fwgw (CVE-2026-2880), patched in 9.2.0.

RemediationAI

Vendor-released patch: upgrade @fastify/middie to >= 9.3.2, which reads the deprecated top-level ignoreDuplicateSlashes option and closes the normalization gap; this is the primary and complete fix (advisory: https://github.com/fastify/middie/security/advisories/GHSA-v9ww-2j6r-98q6). If you cannot upgrade immediately, the vendor-endorsed workaround is to migrate configuration from the deprecated top-level form fastify({ ignoreDuplicateSlashes: true }) to fastify({ routerOptions: { ignoreDuplicateSlashes: true } }), which middie already honors correctly and which removes the disagreement; the trade-off is a small config change with equivalent routing behavior. Alternatively, disabling ignoreDuplicateSlashes entirely also eliminates the bypass, but the side effect is that requests with duplicate slashes will no longer be silently normalized and may 404, which can break clients that rely on that normalization. There is no additional mitigation beyond patching or reconfiguring the option.