CVE-2026-2880 is a critical (CVSS 9.1) authorization bypass in @fastify/middie before version 9.2.0. When router normalization options are on, crafted paths can skip middleware such as app.use('/secret', auth) and still reach the protected handler. The fix is 9.2.0.
What's affected
The GitHub advisory lists the npm package @fastify/middie before 9.2.0 as affected, with 9.1.0 confirmed. The fixed version is 9.2.0.
The issue appears when Fastify router normalization options are enabled, such as ignoreDuplicateSlashes, useSemicolonDelimiter and related trailing-slash behavior, and when you protect paths with path-scoped middleware.
How to check if you're exposed
Check the version:
npm ls @fastify/middie
Then search your code for path-scoped use of middleware and the router options:
grep -rn "ignoreDuplicateSlashes\|useSemicolonDelimiter" src
If both are present on a version below 9.2.0, you are in the affected setup.
What to do now
- Upgrade
@fastify/middieto 9.2.0 or later. - Enforce authentication and authorization at the route level, in hooks that run after the router has normalized the path, as the advisory advises.
- Review router normalization options and disable risky combinations if that is feasible for your service.
- Test protected routes with duplicate slashes and semicolon parameters after the upgrade, using your own staging systems.
Why it matters
The record lists CWE-20, improper input validation, and the advisory calls the cause canonicalization drift. Two components looked at the same URL and came to different conclusions. The middleware compared the raw path with its prefix, while the router normalized the path before choosing a handler.
When a security check and a router disagree about what a path is, attackers get to pick the version that suits them. It is the same family of bug as many request smuggling and path confusion flaws.
The lasting fix for this design is to check access after routing, close to the handler, so the decision uses the same path the handler receives. The record does not mark the CVE as exploited in the wild.
Quick check
Does every app using @fastify/middie have the problem?
No. The advisory ties it to path-scoped middleware combined with router normalization options. Upgrade anyway, since configuration can change later.
Sources
Last reviewed: 19 October 2026.
