EUVD-2026-70979Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network request with no interaction bypasses access control (PR:N/UI:N/AC:L); protected data read and altered give C:H/I:H, no direct availability loss so A:N.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
4DescriptionCVE.org
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.
AnalysisAI
Path-based access-control bypass in @fastify/middie (Fastify's Express-style middleware engine) versions 9.1.0 through 9.3.3 lets an unauthenticated remote attacker skip path-scoped middleware - including authentication and authorization - by sending an absolute-form request target. Middie matches middleware against the raw request target while the Fastify router resolves absolute-form targets to their path before dispatch, so the handler runs but the guarding middleware does not. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Fastify application uses @fastify/middie (9.1.0-9.3.3) with PATH-SCOPED middleware - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), which is consistent with the description: a network-reachable, unauthenticated, low-complexity request that requires no user interaction and yields high confidentiality and integrity impact by reaching handlers that should have been gated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @fastify/middie to 9.3.4 or later (npm install @fastify/middie@^9.3.4, then rebuild and redeploy), per GHSA-hx87-8wv7-pjv8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all applications and services using @fastify/middie versions 9.1.0-9.3.3 by scanning package.json and lock files, and identify which handle sensitive operations or authentication. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fastify Middie
View allAuthentication bypass in @fastify/middie 9.3.1 and earlier lets unauthenticated attackers reach protected routes because
Authentication and authorization bypass in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers rea
Middleware path-matching bypass in @fastify/middie before version 9.1.0 allows authenticated attackers to access protect
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Denial of service in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers crash the Node.js process
Authentication and authorization bypass in @fastify/middie 9.3.1 and earlier lets remote unauthenticated attackers reach
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today