Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

@fastify/middie allows unauthenticated requests to bypass middleware

CVE-2026-112712 · published 3 days ago
Summary

Versions 9.0.0 through 9.3.5 of the @fastify/middie plugin could skip path‑specific middleware such as authentication or rate limiting, letting a single request reach the route handler without those checks. This happens when the plugin’s internal path handling does not match the route’s path, causing the middleware to be ignored. Upgrade to version 9.3.6 or newer, or move critical checks to a Fastify hook that runs after routing to protect your application.

What to do
  • Update @fastify/middie @fastify/middie to version 9.3.6 or later.
Affected software
VendorProductAffected versions
@fastify/middie @fastify/middie < 9.3.6
Original advisory text
@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-436Interpretation Conflict
Timeline
Published20 Oct 2026
Updated22 Oct 2026
First seen20 Oct 2026
Sources
CVE-2026-112712 · NVD
CVE-2026-112712 · MITRE
CVE-2026-112712 · OSV
GHSA-5p92-8765-9fv8 · GHSA
Track software like this
Free during beta