Crucially, when the router and the middleware engine disagree on the path, the middleware (intended for authentication, authorization, or rate limiting) is silently bypassed, but the intended route handler continues to execute. This vulnerability effectively allows an unauthenticated request to bypass security controls by targeting paths that exploit the path-mismatch. The vulnerability is resolved in @fastify/middie 9.3.6.

Impact

Successful exploitation allows for the bypass of security guards such as authentication, authorization, and rate-limiting. This can lead to unauthenticated access to sensitive API endpoints, potential data exfiltration, or unauthorized execution of administrative functions within the application. The severity is reflected in a CVSS v3.1 base score of 9.1, indicating a critical impact for organizations relying on middie for access control.

Recommendation

• Upgrade the @fastify/middie package to version 9.3.6 or later immediately to resolve the underlying path-joining logic issue (CVE-2026-112712).
• As an immediate, temporary mitigation, transition security authorization logic from middie-based path-scoped middleware to Fastify preHandler hooks, which execute after the router has resolved the request path.
• Audit existing middleware configurations to identify instances where plugin scope prefixes or array-based mount paths are used, as these configurations are most susceptible to the path-mismatch logic.