CVE-2026-2880 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
A path normalization inconsistency in @fastify/middie can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)).
When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.
An unauthenticated remote attacker can access endpoints intended to be protected by middleware-based auth/authorization controls by sending specially crafted URL paths (for example, //secret or /secret;foo=bar), depending on router option configuration.
This may lead to unauthorized access to protected functionality and data exposure.
@fastify/[email protected]The issue is caused by canonicalization drift between:
@fastify/middie path matching for app.use('/prefix', ...), andBecause middleware and router did not always evaluate the same normalized path, auth middleware could be skipped while route resolution still succeeded.
Until patched version is deployed:
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.