@fastify/middie EUVD-2026-105361

Exploitation requires an application using @fastify/middie (9.0.0-9.3.5) that relies on path-scoped middleware registered via use() for a security function - authentication, authorization, or rate limiting - AND a mount-path configuration that causes middie's joined path to diverge from the route Fastify's router serves. The specific triggering conditions named in the advisory are: a plugin scope prefix that ends in a slash (the most common case), an array mount path, or a mount path written without a leading slash. No special attacker conditions apply once such a configuration exists - a single unauthenticated remote request suffices (consistent with PR:N/UI:N/AC:L). Limiting factors: applications that enforce authorization in a Fastify preHandler (or other post-routing) hook rather than in middie middleware are not exploitable, and deployments whose mount paths do not match the divergent patterns are unaffected, so this is not exploitable against an arbitrary default middie install.

This is a genuinely high-priority flaw, but its real-world risk is strongly conditioned on deployment specifics rather than being universally exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N) scores 9.1 and describes an unauthenticated, network-reachable, low-complexity security-control bypass with high confidentiality and integrity impact - consistent with CWE-436 (Interpretation Conflict) where @fastify/middie and Fastify's router disagree on the served path. The severity is credible because a single unauthenticated request can slip past path-scoped authentication, authorization, or rate-limiting middleware while the route handler still executes. However, no EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation; the 9.1 reflects worst-case impact, not observed attacks. The critical nuance the raw score hides is that exploitation requires the application to (a) rely on middie path-scoped middleware for security and (b) use one of the specific mount-path patterns that trigger the divergence (scope prefix ending in a slash, array mount paths, or mount paths without a leading slash). Applications that enforce authorization in a Fastify preHandler hook are not affected. Net: treat as an urgent patch for any Fastify deployment using middie for security middleware, but recognize real risk is gated by configuration, so an inventory/config review should accompany prioritization.

A Fastify service uses @fastify/middie to apply authentication middleware scoped to an admin path, but the plugin scope prefix ends in a slash, causing middie's computed mount path to diverge from the route Fastify actually serves. An attacker sends a single crafted, unauthenticated HTTP request to a protected endpoint; the auth middleware is silently skipped while the underlying route handler executes, granting unauthorized access. No public exploit code is identified in the provided data, but the condition is deterministic once the vulnerable mount-path pattern is present.