CVE-2026-2880: Fastify Middie Auth Bypass Vulnerability

CVE-2026-2880 Overview

A vulnerability in @fastify/middie versions prior to 9.2.0 can result in authentication and authorization bypass when using path-scoped middleware. When Fastify router normalization options are enabled—such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior—crafted request paths may bypass middleware checks while still being routed to protected handlers.

This authentication bypass vulnerability occurs due to improper input validation (CWE-20) in how the middleware processes path-scoped configurations. Attackers can exploit the discrepancy between how @fastify/middie validates paths and how the Fastify router normalizes them, allowing unauthorized access to protected endpoints.

Critical Impact

Attackers can bypass authentication and authorization mechanisms by crafting malicious request paths, potentially gaining unauthorized access to protected resources and sensitive data.

Affected Products

• @fastify/middie versions < 9.2.0
• Applications using path-scoped middleware with router normalization options enabled
• Fastify applications with ignoreDuplicateSlashes, useSemicolonDelimiter, or trailing-slash normalization configured

Discovery Timeline

• 2026-02-27 - CVE-2026-2880 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-2880

Vulnerability Analysis

This authorization bypass vulnerability stems from a path normalization inconsistency between @fastify/middie and the Fastify router. When developers configure path-scoped middleware to protect specific routes (for example, app.use('/secret', auth)), they expect all requests to those paths to pass through the authentication middleware. However, when Fastify's router normalization options are enabled, the middleware and router handle path matching differently.

The middleware performs its path check before normalization occurs, while the router normalizes the path before matching it to handlers. This creates a window where specially crafted paths can slip past middleware validation but still route successfully to protected endpoints.

Root Cause

The root cause is improper input validation (CWE-20) in the path matching logic of @fastify/middie. The middleware does not account for Fastify's router normalization behaviors when validating whether a request path matches a protected scope. Specifically:

• Duplicate Slash Handling: When ignoreDuplicateSlashes is enabled, paths like //secret or /secret//endpoint may bypass middleware configured for /secret
• Semicolon Delimiter: The useSemicolonDelimiter option allows semicolons to act as path separators, which the middleware may not properly validate
• Trailing Slash Behavior: Inconsistent handling of trailing slashes between middleware path matching and router normalization

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft HTTP requests with manipulated paths that:

1. Fail to match the middleware's path-scoping logic
2. Successfully match the router's normalized path to a protected handler

For example, if an application uses app.use('/secret', authMiddleware) to protect all routes under /secret, an attacker might craft requests using duplicate slashes, semicolon delimiters, or other normalization-exploitable patterns to access those routes without triggering the authentication middleware.

The vulnerability manifests in the path matching logic when router normalization options are enabled. Attackers can construct paths that exploit the discrepancy between middleware validation and router normalization. For detailed technical information and specific bypass techniques, see the GitHub Security Advisory.

Detection Methods for CVE-2026-2880

Indicators of Compromise

• Unusual request paths containing duplicate slashes (//), semicolons, or unexpected trailing slash patterns in server access logs
• Successful access to protected endpoints from unauthenticated sessions or unexpected sources
• Authentication middleware logs showing fewer requests than expected for protected routes
• Discrepancies between middleware access counts and handler invocation counts for secured paths

Detection Strategies

• Implement logging at both the middleware layer and handler layer to detect path normalization bypass attempts
• Monitor for HTTP requests with non-standard path patterns such as duplicate slashes, semicolon delimiters, or unusual URL encoding
• Compare authentication middleware execution counts against protected handler invocations to identify bypass attempts
• Deploy Web Application Firewall (WAF) rules to detect and block requests with path manipulation patterns

Monitoring Recommendations

• Enable verbose logging for both @fastify/middie and Fastify router to capture path processing details
• Set up alerts for requests containing path normalization characters targeting protected endpoints
• Implement rate limiting and anomaly detection for requests with unusual path patterns
• Review access logs regularly for successful requests to protected resources that lack corresponding authentication events

How to Mitigate CVE-2026-2880

Immediate Actions Required

• Upgrade @fastify/middie to version 9.2.0 or later immediately
• Audit all path-scoped middleware configurations in your Fastify applications
• Review router normalization settings (ignoreDuplicateSlashes, useSemicolonDelimiter, trailing-slash options) and assess their necessity
• Implement additional authorization checks within route handlers as defense-in-depth

Patch Information

The vulnerability is addressed in @fastify/middie version 9.2.0. Organizations should upgrade to this version or later to resolve the authentication bypass vulnerability. For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Disable router normalization options (ignoreDuplicateSlashes, useSemicolonDelimiter) if they are not strictly required for application functionality
• Implement authentication and authorization checks directly within route handlers rather than relying solely on path-scoped middleware
• Add a global middleware that normalizes request paths before they reach path-scoped middleware
• Use route-level hooks (preHandler) for authentication instead of path-scoped middleware with app.use()

# Update @fastify/middie to patched version
npm update @fastify/middie@^9.2.0

# Or install specifically
npm install @fastify/middie@9.2.0

# Verify installed version
npm list @fastify/middie