Unauthenticated authorization bypass via normalization drift

Improper path normalization in Fastify @fastify/middie before 9.2.0 allows remote attackers to bypass path-scoped authorization. The middleware engine fails to apply the router's duplicate-slash, semicolon-delimiter, and trailing-slash rules before matching middleware prefixes, so the guard and handler evaluate different paths. Exploitation requires path-scoped authentication middleware plus a matching router normalization option and grants unauthenticated access to protected functions or data.