Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and authorization checks. This only affects applications using the deprecated ignoreDuplicateSlashes option. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds other than disabling the ignoreDuplicateSlashes option.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-16 | 2 | Disclosure1Patch1 |
| 2026-04-17 | 2 | Disclosure2 |
🚨 High-severity security fix in @fastify/middie@9.3.2 just released! Patches CVE-2026-33804 — middleware bypass via deprecated ignoreDuplicateSlashes option https://github.com/fastify/middie/security/advisories/GHSA-v9ww-2j6r-98q6
Post summary
A high‑severity fix for CVE-2026-33804, affecting Fastify’s middie via the deprecated ignoreDuplicateSlashes option, has just been released.
🚨*CVE* CVE-2026-33804 @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware pa… https://www.cve.org/CVERecord?id=CVE-2026-33804 ----- Traducción: CVE-2026-33804: la… http://infoflow.cloud`
Post summary
The tweet announces the discovery of CVE-2026-33804 affecting @fastapi/middie versions 9.3.1 and earlier due to a middleware bypass when the deprecated ignoreDuplicateSlashes option is enabled.
CVE-2026-33804 @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware pa… https://www.cve.org/CVERecord?id=CVE-2026-33804
Post summary
The post announces that @fastify/middie versions 9.3.1 and earlier are vulnerable to a middleware bypass when the deprecated ignoreDuplicateSlashes option is enabled, referencing CVE-2026-33804.
CVE-2026-33804 Middleware Bypass in @fastify/middie 9.3.1 via Duplicate Slash No... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33804 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A middleware bypass vulnerability has been disclosed for @fastify/middie 9.3.1, triggered by a duplicate slash; detailed information is available on Vulmon.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify\/middie | - | node.js | - |