Skip to content
Threat Feed
Subscribe

Tag

Middleware-Bypass

6 briefs RSS
critical advisory

Sentry-Javascript: Middleware bypass via tunnelRoute (CVE-2026-114139)

A middleware bypass vulnerability in the @sentry/nextjs SDK allows unauthenticated access to routes if the configured tunnel path overlaps with application routes in Webpack-based builds.

@sentry/nextjs +2 web-application middleware-bypass cve-2026-114139
1t 1c
high advisory

OpenNext Cloudflare Middleware Bypass via Cache Interception

The @opennextjs/cloudflare component contains a vulnerability (CVE-2026-100409) where inconsistent path decoding allows attackers to bypass middleware-based authorization and retrieve cached content.

@opennextjs/cloudflare web-application middleware-bypass cloudflare cve-2026-100409
1t 1c
high threat

Path-Scoped Middleware Bypass in @nestjs/platform-fastify

An improper handling of absolute-form HTTP request targets in @nestjs/platform-fastify allows attackers to bypass path-scoped middleware by inducing a path resolution mismatch between the router and the middleware layer.

exploited @nestjs/platform-fastify +1 middleware-bypass web-application-security nestjs fastify npm
2t
high advisory

Next.js App Router Middleware/Proxy Bypass Vulnerability (CVE-2026-64642)

A high-severity vulnerability, CVE-2026-64642, in Next.js App Router applications built with Turbopack and configured with a single locale entry allows attackers to bypass middleware and proxy-based authentication mechanisms through specially crafted HTTP requests, leading to unauthorized access to protected resources.

Next.js web-vulnerability middleware-bypass turbopack CVE-2026-64642
2t
high advisory

@fastify/middie Middleware Bypass Vulnerability via Duplicate Slashes

`@fastify/middie` versions 9.3.1 and earlier are vulnerable to middleware bypass via URLs with duplicate leading slashes due to improper handling of the deprecated `ignoreDuplicateSlashes` option, potentially allowing unauthorized access to protected resources.

Fastify +1 middie middleware-bypass vulnerability defense-evasion
2r 1t 1c
high advisory

FlightPHP HTTP Method Override Vulnerability Leads to CSRF and Middleware Bypass

A vulnerability in FlightPHP core versions before 3.18.1 allows attackers to override HTTP methods via the `X-HTTP-Method-Override` header or `_method` parameter, leading to CSRF escalation, middleware bypass, and cache poisoning.

flightphp/core csrf middleware-bypass cache-poisoning http-method-override
2r 1t