8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-2880

CVE-2026-2880: @fastify/middie has an improper path normalization vulnerability

A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)).

When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-2880

CVE-2026-2880:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@fastify/middie	npm	< 9.2.0	9.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path normalization inconsistency between the @fastify/middie middleware and the Fastify router. The root cause is that the middleware engine did not use the same path normalization rules as the router. An attacker could craft a URL (e.g., //secret instead of /secret) that would fail to match the middleware's path rule, thus bypassing authentication or authorization checks. However, the Fastify router would normalize this path, routing the request to the protected endpoint as if the middleware had been successfully passed.

The analysis of the patch commit 140e0dd0359d890fec7e6ea1dcc5134d6bd554d4 reveals two key functions involved:

fastifyMiddie in index.js: This function is the plugin's entry point. The patch shows that it was modified to read the routerOptions (like ignoreDuplicateSlashes, useSemicolonDelimiter, etc.) from the Fastify instance and pass them to the middie engine. Previously, it initialized the engine without these options, causing the engine to be unaware of the router's normalization behavior.
middie in lib/engine.js: This is the core middleware processing engine. The patch modifies it to accept the router options and introduces a new normalizePathForMatching helper function. This new function explicitly applies the same normalization logic that the Fastify router uses (removeDuplicateSlashes, sanitizeUrlPath, trimLastSlash). The middleware matching logic was updated to use this consistently normalized path, closing the bypass vulnerability.

Therefore, both fastifyMiddie and middie are identified as the vulnerable functions, as they were responsible for the inconsistent handling of URL paths that led to the security flaw.

Vulnerable functions

middie

lib/engine.js

The `middie` function in `lib/engine.js` is the core middleware engine. Before the patch, it performed path matching using a URL that was not normalized in the same way as the Fastify router. Specifically, it used `FindMyWay.sanitizeUrlPath` but did not account for other router normalization options like `ignoreDuplicateSlashes`. This inconsistency allowed crafted URLs to bypass middleware checks but still be correctly routed by Fastify, leading to an authorization bypass. The patch fixes this by introducing a `normalizePathForMatching` function that mirrors the router's behavior and uses the resulting normalized path for middleware matching.

fastifyMiddie

index.js

The `fastifyMiddie` function is the main plugin entry point that integrates the `middie` engine with Fastify. In the vulnerable version, this function initialized the `middie` engine without passing along the Fastify router's normalization settings. This omission is a key part of the vulnerability, as it prevented the middleware engine from knowing how to properly normalize paths to match the router's behavior. The patch corrects this by reading the `routerOptions` from the Fastify instance and passing them to the `middie` constructor.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.