@fastify/middie: Authorization bypass in path-scoped middleware
Summary
The Express-style middleware engine for Fastify stores some path-scoped middleware under a mount path that does not match the path the router serves. Typical triggers are plugin prefixes ending in a slash, array mount paths, and mount paths without a leading slash. In these cases the middleware is silently skipped while the route handler still runs, so authentication, authorization or rate limiting can be bypassed with a single unauthenticated request.
Affected
- @fastify/middie 9.0.0 up to but not including 9.3.6
- Applications that depend on this package, including transitive dependencies
Fixed in
- Fixed in @fastify/middie 9.3.6
Workaround
- Enforce authorization in a Fastify hook such as preHandler, which runs after the router has resolved the request.
Exploitation
- Not known as exploited (not in CISA KEV at the time of research).
- No public proof of concept found; this does not prove none exists.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Check lockfiles and deployed builds for @fastify/middie versions 9.0.0 to 9.3.5, including transitive dependencies.
- Upgrade to 9.3.6 or later and redeploy.
- Review routes protected only by path-scoped middleware and check logs for unexpected successful requests.
- If patching is delayed, add preHandler authorization to sensitive routes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5p92-8765-9fv8 github.com
- OpenJS CNA Security Advisories cna.openjsf.org
- @fastify/middie release v9.3.6 github.com
- HOL Guard CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:06.
Original description (NVD)
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.