CVE-2026-2880: Fastify Middie Auth Bypass Vulnerability

CVE-2026-2880 Overview

A vulnerability in @fastify/middie versions prior to 9.2.0 can result in authentication and authorization bypass when using path-scoped middleware. When Fastify router normalization options are enabled—such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior—crafted request paths may bypass middleware checks while still being routed to protected handlers.

This authentication bypass vulnerability occurs due to improper input validation (CWE-20) in how the middleware processes path-scoped configurations. Attackers can exploit the discrepancy between how @fastify/middie validates paths and how the Fastify router normalizes them, allowing unauthorized access to protected endpoints.

Critical Impact
Attackers can bypass authentication and authorization mechanisms by crafting malicious request paths, potentially gaining unauthorized access to protected resources and sensitive data.

Affected Products

@fastify/middie versions < 9.2.0
Applications using path-scoped middleware with router normalization options enabled
Fastify applications with ignoreDuplicateSlashes, useSemicolonDelimiter, or trailing-slash normalization configured

Discovery Timeline

2026-02-27 - CVE-2026-2880 published to NVD
2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-2880

Vulnerability Analysis

This authorization bypass vulnerability stems from a path normalization inconsistency between @fastify/middie and the Fastify router. When developers configure path-scoped middleware to protect specific routes (for example, app.use('/secret', auth)), they expect all requests to those paths to pass through the authentication middleware. However, when Fastify's router normalization options are enabled, the middleware and router handle path matching differently.

The middleware performs its path check before normalization occurs, while the router normalizes the path before matching it to handlers. This creates a window where specially crafted paths can slip past middleware validation but still route successfully to protected endpoints.

Root Cause

The root cause is improper input validation (CWE-20) in the path matching logic of @fastify/middie. The middleware does not account for Fastify's router normalization behaviors when validating whether a request path matches a protected scope. Specifically:

Duplicate Slash Handling: When ignoreDuplicateSlashes is enabled, paths like //secret or /secret//endpoint may bypass middleware configured for /secret
Semicolon Delimiter: The useSemicolonDelimiter option allows semicolons to act as path separators, which the middleware may not properly validate
Trailing Slash Behavior: Inconsistent handling of trailing slashes between middleware path matching and router normalization

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft HTTP requests with manipulated paths that:

Fail to match the middleware's path-scoping logic
Successfully match the router's normalized path to a protected handler

For example, if an application uses app.use('/secret', authMiddleware) to protect all routes under /secret, an attacker might craft requests using duplicate slashes, semicolon delimiters, or other normalization-exploitable patterns to access those routes without triggering the authentication middleware.

The vulnerability manifests in the path matching logic when router normalization options are enabled. Attackers can construct paths that exploit the discrepancy between middleware validation and router normalization. For detailed technical information and specific bypass techniques, see the GitHub Security Advisory.

Detection Methods for CVE-2026-2880

Indicators of Compromise

Unusual request paths containing duplicate slashes (//), semicolons, or unexpected trailing slash patterns in server access logs
Successful access to protected endpoints from unauthenticated sessions or unexpected sources
Authentication middleware logs showing fewer requests than expected for protected routes
Discrepancies between middleware access counts and handler invocation counts for secured paths

Detection Strategies

Implement logging at both the middleware layer and handler layer to detect path normalization bypass attempts
Monitor for HTTP requests with non-standard path patterns such as duplicate slashes, semicolon delimiters, or unusual URL encoding
Compare authentication middleware execution counts against protected handler invocations to identify bypass attempts
Deploy Web Application Firewall (WAF) rules to detect and block requests with path manipulation patterns

Monitoring Recommendations

Enable verbose logging for both @fastify/middie and Fastify router to capture path processing details
Set up alerts for requests containing path normalization characters targeting protected endpoints
Implement rate limiting and anomaly detection for requests with unusual path patterns
Review access logs regularly for successful requests to protected resources that lack corresponding authentication events

How to Mitigate CVE-2026-2880

Immediate Actions Required

Upgrade @fastify/middie to version 9.2.0 or later immediately
Audit all path-scoped middleware configurations in your Fastify applications
Review router normalization settings (ignoreDuplicateSlashes, useSemicolonDelimiter, trailing-slash options) and assess their necessity
Implement additional authorization checks within route handlers as defense-in-depth

Patch Information

The vulnerability is addressed in @fastify/middie version 9.2.0. Organizations should upgrade to this version or later to resolve the authentication bypass vulnerability. For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

Disable router normalization options (ignoreDuplicateSlashes, useSemicolonDelimiter) if they are not strictly required for application functionality
Implement authentication and authorization checks directly within route handlers rather than relying solely on path-scoped middleware
Add a global middleware that normalizes request paths before they reach path-scoped middleware
Use route-level hooks (preHandler) for authentication instead of path-scoped middleware with app.use()

bash

# Update @fastify/middie to patched version
npm update @fastify/middie@^9.2.0

# Or install specifically
npm install @fastify/middie@9.2.0

# Verify installed version
npm list @fastify/middie