Skip to main content

Fastify Middie EUVDEUVD-2026-23235

| CVE-2026-33804 HIGH
Interpretation Conflict (CWE-436)
2026-04-16 openjs GHSA-v9ww-2j6r-98q6
Authentication Bypass Fastify Middie
7.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Patch released
Apr 22, 2026 - 17:30 nvd
Patch available
Patch available
Apr 16, 2026 - 15:01 EUVD
EUVD ID Assigned
Apr 16, 2026 - 15:00 euvd
EUVD-2026-23235
CVE Published
Apr 16, 2026 - 13:56 nvd
HIGH 7.4

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 4 npm packages depend on @fastify/middie (3 direct, 1 indirect)

Ecosystem-wide dependent count for version 9.3.2.

DescriptionCVE.org

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.

Analysis

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.

More in Fastify Middie

View all
CVE-2026-6270 CRITICAL
9.1 Apr 16

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instance
CVE-2026-14198 CRITICAL
9.1 Jul 01

Authentication and authorization bypass in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers rea
CVE-2026-22031 HIGH
8.4 Jan 19

Middleware path-matching bypass in @fastify/middie before version 9.1.0 allows authenticated attackers to access protect
CVE-2026-2880 HIGH
8.2 Feb 27

Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
CVE-2026-14181 HIGH
7.5 Jul 01

Denial of service in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers crash the Node.js process

Same weakness CWE-436 – Interpretation Conflict

View all
CVE-2024-24754 CRITICAL POC
9.8
CVE-2023-24813 CRITICAL POC
9.8
CVE-2019-19589 CRITICAL POC
9.8
CVE-2025-12816 HIGH POC
8.6
CVE-2026-6322 HIGH POC
7.5
CVE-2019-17596 HIGH POC
7.5
CVE-2023-49284 MEDIUM POC
6.6
CVE-2024-24753 MEDIUM POC
6.5

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

EUVD-2026-23235 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy