Cardiff showed two changes from the side that drew at Doncaster, with the injured Kevin McNaughton replaced by Darcy Blake and Jay Bothroyd in for Peter Whittingham, who was on the bench.
City went ahead after just 129 seconds when Bothroyd sent McCormack through. He evaded a challenge before rifling home from 15 yards.
Norwich were thrown a lifeline in the eighth minute when Joe Ledley brought down Matty Pattison just inside the area, but Jamie Cureton struck the spot-kick wide.
A snapshot from the busy Pattison in the 28th minute appeared to go under Tom Heaton in the home goal and rebound off the post into his arms.
Cardiff were giving away too many free-kicks in dangerous areas, but fortunately the Canaries were unable to take advantage as the half drew to a close.
As the second period progressed, the Bluebirds were on top but just couldn't find the final ball to put the visitors away.
Pattison tried a snapshot in the 63rd minute that had Heaton scrambling across goal but the ball flew wide of the far post.
Three minutes later McCormack was brought down by John Kennedy after spinning in the area and he took the penalty himself to deservedly fire City further ahead.
The Canaries almost reduced the deficit immediately when Pattison's shot was on target, but Roger Johnson raced across to hack off the line.
Lupoli had only been on the field two minutes when he reduced the deficit from what looked like an offside position, after the home defence failed to clear and he was left unmarked.
Norwich began to up the tempo in the closing stages and now it was the Bluebirds hanging on and Lupoli added his second with a diving header in the 81st minute.
Pattison cleared off the line from Steve Thompson and then Whittingham's shot was tipped over by David Marshall as the Bluebirds tried in vain to recover from the double blow.