Fastify Middie
Monthly
Path-based access-control bypass in @fastify/middie (Fastify's Express-style middleware engine) versions 9.1.0 through 9.3.3 lets an unauthenticated remote attacker skip path-scoped middleware - including authentication and authorization - by sending an absolute-form request target. Middie matches middleware against the raw request target while the Fastify router resolves absolute-form targets to their path before dispatch, so the handler runs but the guarding middleware does not. No public exploit was identified at time of analysis, but the flaw is trivially triggerable and remediated in 9.3.4.
Denial of service in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers crash the Node.js process by sending request paths with malformed percent-encoded sequences. The standalone engine's URL normalization step fails to catch a synchronous decoder exception, terminating the process and taking down all connected clients until manual restart. Only applications that invoke middie.run directly on the standalone engine API are affected; there is no public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Authentication and authorization bypass in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers reach protected parameterized route handlers by placing an encoded slash (%2F) in a path parameter. The middleware layer decodes %2F before matching while Fastify's router preserves the encoding, so the two disagree on the canonical path and any middie-based auth, authz, rate-limiting, or auditing middleware silently fails to run while the route handler still fires. No public exploit identified at time of analysis; the flaw is method-agnostic and requires no special preconditions, and the vendor rates it CVSS 9.1.
Authentication and authorization bypass in @fastify/middie 9.3.1 and earlier lets remote unauthenticated attackers reach protected routes by sending URLs with duplicate leading slashes (e.g. //admin/secret) when the deprecated top-level Fastify ignoreDuplicateSlashes option is enabled. Because middie reads the option only from routerOptions while Fastify's router still honors the top-level form, a normalization gap allows middleware-enforced checks to be skipped. There is no public exploit identified at time of analysis and EPSS is negligible (0.04%), but SSVC rates technical impact as total, reflecting a full auth-check bypass on affected deployments.
Authentication bypass in @fastify/middie 9.3.1 and earlier lets unauthenticated attackers reach protected routes because inherited middleware is not registered directly on child plugin engine instances. When a Fastify app defines auth/authz middleware in a parent scope and mounts child plugins through middie, those child-scope routes silently skip the parent's checks, exposing them to anyone. Rated CVSS 9.1; SSVC lists a public PoC and total technical impact, though EPSS is only 0.03% and there is no evidence of active exploitation.
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauthenticated attackers to access protected endpoints by exploiting path normalization inconsistencies. When Fastify router normalization options (ignoreDuplicateSlashes, useSemicolonDelimiter, trailing-slash handling) are enabled, crafted URL paths bypass path-scoped middleware checks while still routing to protected handlers. Confirmed actively exploited (CISA KEV). Patch available in version 9.2.0. EPSS score of 0.17% (38th percentile) suggests limited widespread exploitation despite active use, likely indicating targeted attacks against known vulnerable deployments.
Middleware path-matching bypass in @fastify/middie before version 9.1.0 allows authenticated attackers to access protected endpoints by using URL-encoded characters in requests, as the middleware engine fails to decode paths while the underlying router does. An attacker with valid credentials can exploit this inconsistency to circumvent middleware security controls and access restricted functionality. This vulnerability requires low privileges and network access, with no patch currently available.
Path-based access-control bypass in @fastify/middie (Fastify's Express-style middleware engine) versions 9.1.0 through 9.3.3 lets an unauthenticated remote attacker skip path-scoped middleware - including authentication and authorization - by sending an absolute-form request target. Middie matches middleware against the raw request target while the Fastify router resolves absolute-form targets to their path before dispatch, so the handler runs but the guarding middleware does not. No public exploit was identified at time of analysis, but the flaw is trivially triggerable and remediated in 9.3.4.
Denial of service in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers crash the Node.js process by sending request paths with malformed percent-encoded sequences. The standalone engine's URL normalization step fails to catch a synchronous decoder exception, terminating the process and taking down all connected clients until manual restart. Only applications that invoke middie.run directly on the standalone engine API are affected; there is no public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Authentication and authorization bypass in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers reach protected parameterized route handlers by placing an encoded slash (%2F) in a path parameter. The middleware layer decodes %2F before matching while Fastify's router preserves the encoding, so the two disagree on the canonical path and any middie-based auth, authz, rate-limiting, or auditing middleware silently fails to run while the route handler still fires. No public exploit identified at time of analysis; the flaw is method-agnostic and requires no special preconditions, and the vendor rates it CVSS 9.1.
Authentication and authorization bypass in @fastify/middie 9.3.1 and earlier lets remote unauthenticated attackers reach protected routes by sending URLs with duplicate leading slashes (e.g. //admin/secret) when the deprecated top-level Fastify ignoreDuplicateSlashes option is enabled. Because middie reads the option only from routerOptions while Fastify's router still honors the top-level form, a normalization gap allows middleware-enforced checks to be skipped. There is no public exploit identified at time of analysis and EPSS is negligible (0.04%), but SSVC rates technical impact as total, reflecting a full auth-check bypass on affected deployments.
Authentication bypass in @fastify/middie 9.3.1 and earlier lets unauthenticated attackers reach protected routes because inherited middleware is not registered directly on child plugin engine instances. When a Fastify app defines auth/authz middleware in a parent scope and mounts child plugins through middie, those child-scope routes silently skip the parent's checks, exposing them to anyone. Rated CVSS 9.1; SSVC lists a public PoC and total technical impact, though EPSS is only 0.03% and there is no evidence of active exploitation.
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauthenticated attackers to access protected endpoints by exploiting path normalization inconsistencies. When Fastify router normalization options (ignoreDuplicateSlashes, useSemicolonDelimiter, trailing-slash handling) are enabled, crafted URL paths bypass path-scoped middleware checks while still routing to protected handlers. Confirmed actively exploited (CISA KEV). Patch available in version 9.2.0. EPSS score of 0.17% (38th percentile) suggests limited widespread exploitation despite active use, likely indicating targeted attacks against known vulnerable deployments.
Middleware path-matching bypass in @fastify/middie before version 9.1.0 allows authenticated attackers to access protected endpoints by using URL-encoded characters in requests, as the middleware engine fails to decode paths while the underlying router does. An attacker with valid credentials can exploit this inconsistency to circumvent middleware security controls and access restricted functionality. This vulnerability requires low privileges and network access, with no patch currently available.