CVE-2026-112712: @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@fastify/middieto a version that resolves this vulnerability.Fixed in 9.3.6 - Compensating control
Enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this bypass?
Deployments using @fastify/middie versions 9.0.0 through 9.3.5 are exposed when they rely on path-scoped middleware for controls such as authentication, authorization, or rate limiting. The mismatch occurs most often when a plugin scope prefix ends with a slash, and can also affect array mount paths or mount paths without a leading slash.
What does an attacker need to exploit the issue?
An attacker only needs to send a single unauthenticated network request to a route whose protection depends on affected path-scoped middleware. No privileges or user interaction are required.
Are routes still reachable when the middleware is bypassed?
Yes. When the middleware mount path and Fastify router path disagree, the middleware is silently skipped while the route handler still runs. This can allow protected route logic to execute without the intended middleware checks.
What can be done if an immediate upgrade is not possible?
Enforce authorization in a Fastify hook such as preHandler, which runs after the router has resolved the request. Upgrade @fastify/middie to version 9.3.6 or later when possible.