Path-scoped middleware bypass in @fastify/middie via scope prefix mismatch
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
@fastify/middie from 9.0.0 before 9.3.6 joins a path-scoped middleware's mount path to the plugin scope prefix in a way that can differ from the path Fastify's router serves. When the paths disagree, the middleware is silently skipped while the route handler still runs, which is an interpretation conflict (CWE-436). An unauthenticated remote attacker can bypass path-scoped middleware such as authentication, authorization, or rate limiting with a single request.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade @fastify/middie to 9.3.6 or later, which fixes the issue. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA @fastify/middie (@fastify/middie) Fixed in 9.3.6
Timeline
- 2026-10-21 Threatist record created from CVE-2026-112712
- 2026-10-22 Priority changed: MEDIUM → LOW
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: LOW → MEDIUM
References
More fastify vulnerabilities
- TI-2026-26180 @fastify/express vulnerable to middleware authentication bypass via URL normalization… CVSS 4.0CRITICAL 9.1
- TI-2026-26179 @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
- TI-2026-26177 @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers CVSS 4.0CRITICAL 9.0
- TI-2026-05498 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
- TI-2023-15307 Cross-site request forgery in npm @fastify/oauth2 CVSS 3.1HIGH 8.8
- TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences