| Package | Affected versions | Patched versions |
|---|---|---|
| fastify/middie | < 9.3.2 | 9.3.2 |
| @fastify/middie | < 9.3.2 | 9.3.2 |
@fastify/middie v9.3.1 and earlier does not read the deprecated (but still functional) top-level ignoreDuplicateSlashes option, only reading from routerOptions. This creates a normalization gap: Fastify's router normalizes duplicate slashes but middie does not, allowing middleware bypass via URLs with duplicate leading slashes (e.g., //admin/secret).
This only affects applications using the deprecated top-level configuration style (fastify({ ignoreDuplicateSlashes: true })). Applications using routerOptions: { ignoreDuplicateSlashes: true } are not affected.
This is distinct from GHSA-8p85-9qpw-fwgw (CVE-2026-2880), which was patched in v9.2.0.
Upgrade to @fastify/middie >= 9.3.2.
Migrate from deprecated top-level ignoreDuplicateSlashes: true to routerOptions: { ignoreDuplicateSlashes: true }.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free