CVE-2026-112712

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.0.0 through 9.3.5

Description The use() function joins a path-scoped middleware mount path to the plugin scope prefix in a manner that may diverge from the path served by the Fastify router. This occurs primarily when the scope prefix ends in a slash, when array mount paths are used, or when mount paths lack a leading slash. Such discrepancies cause the middleware to be silently skipped while the route handler continues to execute, potentially allowing a single unauthenticated request to bypass critical path-scoped middleware such as authentication, authorization, or rate limiting.

Recommendations Update @fastify/middie to version 9.3.6 or later. As a temporary workaround, enforce authorization in a Fastify hook such as preHandler that executes after the router has resolved the request.