Fastify Middie Fastify Middie vulnerabilities

CVE-2026-6270 [CRITICAL] CWE-436 CVE-2026-6270: @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child pl @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests

CVE-2026-85184 [CRITICAL] CWE-436 CVE-2026-85184: @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by m @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route ha

CVE-2026-14198 [CRITICAL] CWE-436 CVE-2026-14198: @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter valu @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When

CVE-2026-33804 [CRITICAL] CWE-436 CVE-2026-33804: @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated F @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicate slashes to bypass middleware authentication and au

CVE-2026-2880 [CRITICAL] CWE-20 CVE-2026-2880: A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypas A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)). When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may

CVE-2026-14181 [HIGH] CWE-248 CVE-2026-14181: @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the st @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the mid