{"action":"Upgrade @fastify/middie to 9.2.0 or later.","affected":[{"fixed":"9.2.0","introduced":"0"}],"component":"@fastify/middie","cve_ids":["CVE-2026-2880"],"ecosystem":"npm","epss":0.0043,"exploited":false,"fixed_versions":["9.2.0"],"ghsa_id":"GHSA-8p85-9qpw-fwgw","id":"tcs_01M5KFDM6XR3M411GB2R8QJQK7","modified_at":"2026-02-28T06:56:21.047235Z","published_at":"2026-02-28T02:47:17Z","references":["https://osv.dev/vulnerability/GHSA-8p85-9qpw-fwgw","https://github.com/fastify/middie/security/advisories/GHSA-8p85-9qpw-fwgw","https://nvd.nist.gov/vuln/detail/CVE-2026-2880","https://github.com/fastify/middie/commit/140e0dd0359d890fec7e6ea1dcc5134d6bd554d4","https://fluidattacks.com/advisories/jimenez","https://fluidattacks.com/advisories/policy","https://github.com/fastify/middie","https://github.com/fastify/middie/releases/tag/v9.2.0"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-8p85-9qpw-fwgw","url":"https://osv.dev/vulnerability/GHSA-8p85-9qpw-fwgw"},{"source":"nvd","source_id":"CVE-2026-2880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2880"}],"summary":"@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware"}