CVE-2026-33804 is a middleware bypass in @fastify/middie 9.3.1 and earlier. NVD scores it 7.4. It applies only when the deprecated top level ignoreDuplicateSlashes option is used. Upgrade to 9.3.2 or move the option into routerOptions. It is a gap between how two components read the same URL.
What's affected
Versions up to 9.3.1 are affected, and 9.3.2 fixes it. The advisory says middie did not read the deprecated top level option and only read routerOptions, so Fastify's router normalized duplicate slashes while middie did not. A path with duplicate leading slashes could then skip authentication or authorization middleware. Apps using routerOptions: { ignoreDuplicateSlashes: true } are not affected. It is distinct from CVE-2026-2880, fixed in 9.2.0.
How to check if you're exposed
npm ls @fastify/middie
grep -rn "ignoreDuplicateSlashes" src/
A version at or below 9.3.1 with the option set at the top level of the Fastify constructor is the affected pattern.
What to do now
- Upgrade
@fastify/middieto 9.3.2 or later. - Or migrate to
routerOptions, which the advisory lists as the workaround. - Test protected routes with duplicate slashes after the change.
- Enforce authentication close to the route as defense in depth.
Why it matters
The record uses CWE-436, interpretation conflict. Two components read the same URL differently, and the security check used the version that did not match. The record is not marked as exploited in the wild and is not in CISA KEV.
Normalization bugs are easy to introduce when one library wraps another. Each layer needs to see the same canonical path before any security decision is made. When you test authentication on a framework, include odd but valid URL forms such as repeated slashes, trailing slashes, mixed case and encoded characters, and confirm the protected routes still return an authentication error. Adding such cases to your test suite catches regressions after upgrades.
Quick check
Am I safe if I never set the option?
The advisory limits the issue to apps using the deprecated top level option.
Sources
Last reviewed: 19 October 2026.
