@fastify/middie: Security middleware bypass vulnerability (CVE-2026-112712)

The @fastify/middie middleware engine, used within the Fastify framework, contains a vulnerability (CVE-2026-112712) in versions 9.0.0 through 9.3.5. The vulnerability arises from an improper path-joining logic within the use() function. When a middleware is path-scoped and combined with a plugin scope prefix, the resulting mount path may diverge from the path recognized by the Fastify router. This issue specifically manifests when the scope prefix ends with a slash, when using array mount paths, or when mount paths are defined without a leading slash.

Crucially, when the router and the middleware engine disagree on the path, the middleware (intended for authentication, authorization, or rate limiting) is silently bypassed, but the intended route handler continues to execute. This vulnerability effectively allows an unauthenticated request to bypass security controls by targeting paths that exploit the path-mismatch. The vulnerability is resolved in @fastify/middie 9.3.6.

Impact

Successful exploitation allows for the bypass of security guards such as authentication, authorization, and rate-limiting. This can lead to unauthenticated access to sensitive API endpoints, potential data exfiltration, or unauthorized execution of administrative functions within the application. The severity is reflected in a CVSS v3.1 base score of 9.1, indicating a critical impact for organizations relying on middie for access control.

Recommendation

• Upgrade the @fastify/middie package to version 9.3.6 or later immediately to resolve the underlying path-joining logic issue (CVE-2026-112712).
• As an immediate, temporary mitigation, transition security authorization logic from middie-based path-scoped middleware to Fastify preHandler hooks, which execute after the router has resolved the request path.
• Audit existing middleware configurations to identify instances where plugin scope prefixes or array-based mount paths are used, as these configurations are most susceptible to the path-mismatch logic.