What is GHSA-v9ww-2j6r-98q6?

GHSA-v9ww-2j6r-98q6 is a security advisory published by GitHub Security Advisories with High severity. @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

Which CVE IDs does GHSA-v9ww-2j6r-98q6 cover?

GHSA-v9ww-2j6r-98q6 covers the following CVE IDs: CVE-2026-33804. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v9ww-2j6r-98q6?

GHSA-v9ww-2j6r-98q6 has a CVSS v3 base score of 7.4, published by GitHub Security Advisories.

Which products are affected by GHSA-v9ww-2j6r-98q6?

GHSA-v9ww-2j6r-98q6 affects 1 product, including: npm/@fastify/middie:\u003c= 9.3.1.

GHSA-v9ww-2j6r-98q6HighCVSS 7.4

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

Vendor

GitHub Security Advisories

Published

April 16, 2026

Last Modified

April 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-33804 →

📋 Description

Impact

@fastify/middie v9.3.1 and earlier does not read the deprecated (but still functional) top-level ignoreDuplicateSlashes option, only reading from routerOptions. This creates a normalization gap: Fastify's router normalizes duplicate slashes but middie does not, allowing middleware bypass via URLs with duplicate leading slashes (e.g., //admin/secret).

This only affects applications using the deprecated top-level configuration style (fastify({ ignoreDuplicateSlashes: true })). Applications using routerOptions: { ignoreDuplicateSlashes: true } are not affected.

This is distinct from GHSA-8p85-9qpw-fwgw (CVE-2026-2880), which was patched in v9.2.0.

Patches

Upgrade to @fastify/middie >= 9.3.2.

Workarounds

Migrate from deprecated top-level ignoreDuplicateSlashes: true to routerOptions: { ignoreDuplicateSlashes: true }.

🎯 Affected products1

npm/@fastify/middie:<= 9.3.1