CVE-2026-2880: @fastify/middie Improper Path Normalization Vulnerability
Summary
CVE-2026-2880: @fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware. Affects @fastify/middie versions < 9.2.0. Fixed in 9.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @fastify/middie package is a middleware for the Fastify web framework, designed to facilitate the integration of middleware functions into Fastify applications. It allows developers to use traditional middleware patterns, enhancing the flexibility and functionality of Fastify applications. However, a recent vulnerability has been identified that compromises the security of applications using this package, particularly in scenarios where path-scoped middleware is employed.
Vulnerability Detail
A path normalization inconsistency in @fastify/middie can lead to authentication and authorization bypass when using path-scoped middleware. This issue arises when Fastify router normalization options are enabled, allowing crafted request paths to bypass middleware checks while still being routed to protected handlers. An unauthenticated remote attacker could exploit this vulnerability to access endpoints that should be protected by middleware-based authentication and authorization controls, potentially leading to unauthorized access to sensitive functionality and data exposure.
How To Fix
Minimum fixed version
9.2.0
This is the first release that contains the fix.
npm install @fastify/middie@9.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Until the patched version is deployed, consider implementing the following workarounds: 1. Avoid relying solely on path-scoped middie guards for authentication and authorization. 2. Enforce authentication at route-level handlers or hooks after router normalization. 3. Disable risky normalization combinations if operationally feasible.
Conclusion
The @fastify/middie package has a significant vulnerability (CVE-2026-2880) that could allow unauthorized access to protected endpoints. It is crucial to update to version 9.2.0 or later to mitigate this risk. Until then, implementing the suggested workarounds can help protect your application.
See every vulnerability recorded for @fastify/middie →
FAQ
CVE-2026-2880 is a vulnerability in the @fastify/middie package that allows for authentication and authorization bypass due to improper path normalization.
All versions prior to 9.2.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
If you cannot update the package immediately, implement the suggested workarounds to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for @fastify/middie.
