CVE-2026-2880
@fastify/middie 9.1.0 (fixed 9.2.0)
- Class
- Auth bypass
- Severity
- High · CVSS 4.0 score 8.2
- Disclosed
- Credit
- Cristian Vargas, Fluid Attacks Offensive Team
- Code name
- jimenez
- Affected
- @fastify/middie 9.1.0 (fixed 9.2.0)
The defect
Improper path normalization (middleware bypass)
Class overview · Auth bypass
A request reaches a protected handler without passing the check that guards it. In normalization bugs the security check and the router interpret the same URL differently, and the check fails open.