The @fastify/middie middleware package is vulnerable to an authentication bypass flaw that allows attackers to circumvent security controls when specific deprecated configurations are active.

The vulnerability arises from an interpretation conflict (CWE-436) where the middleware path matching logic fails to normalize duplicate slashes correctly. This allows unauthenticated attackers to bypass intended middleware authentication and authorization checks if the deprecated ignoreDuplicateSlashes option is enabled in the Fastify application.

The exploitation of this flaw can lead to unauthorized access to protected application resources, potentially resulting in data exfiltration or unauthorized modification of application state. With a CVSS score of 7.4, this vulnerability represents a high risk to business operations, as it effectively nullifies existing security layers for affected endpoints.

Immediate Action: Upgrade the @fastify/middie dependency to version 9.3.2 or later to apply the necessary path matching logic fixes.

Proactive Monitoring: Review application access logs for unusual traffic patterns involving multiple slashes in request paths, which may indicate attempted exploitation.

Compensating Controls: If immediate patching is not feasible, disable the deprecated ignoreDuplicateSlashes option within the Fastify configuration to eliminate the attack vector.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to application integrity by allowing attackers to bypass critical security middleware. Administrators should prioritize updating the @fastify/middie package to version 9.3.2 immediately. If the deprecated ignoreDuplicateSlashes option is currently in use, it must be disabled as a primary security measure to prevent unauthorized access.