Zer0D4Y5

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions 9.1.0 through 9.3.3 **Description** A mismatch occurs because the middleware evaluates the raw request target to determine if path-scoped middleware should run, whereas the Fastify router resolves an absolute-form request target to its path before dispatching. This discrepancy allows a request using an absolute-form target to reach the route handler while skipping path-scoped middleware used for authentication, authorization, rate limiting, or auditing. An unauthenticated network attacker can exploit this behavior to bypass path-based access controls. **Recommendations** Update @fastify/middie to version 9.3.4 or later. As a workaround, enforce authentication using a Fastify hook such as `preHandler()`.