CVE-2026-33804

OVERVIEW CVE-2026-33804 is a middleware bypass vulnerability affecting @fastify/middie versions 9.3.1 and earlier. The flaw exists in the middleware path matching logic when the deprecated Fastify ignoreDuplicateSlashes option is enabled. Attackers can craft requests containing duplicate slashes that bypass the normalized path checking, allowing them to circumvent middleware-enforced authentication and authorization controls. The vulnerability only impacts applications explicitly using the deprecated ignoreDuplicateSlashes configuration option. SEVERITY This vulnerability carries a CRITICAL CVSS score of 9.1 with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity and can be executed remotely by any unauthenticated attacker. The potential impact is severe, including high confidentiality and integrity compromise through successful bypass of security controls, though availability is not affected. The EPSS score of 0.000480 indicates exceptionally low real-world exploitation probability relative to the broader CVE population. EXPLOITATION STATUS There is currently no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hotlists. Community attention appears minimal given the low EPSS probability and the requirement for the deprecated configuration option. Remediation is straightforward through upgrade to version 9.3.2 or by disabling the ignoreDuplicateSlashes option.