Description

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-04T10:17:13.900Z",
  "pubdate": "2026-09-04T10:17:13.900Z",
  "executiveSummary": "The @fastify/middie package is susceptible to a security bypass vulnerability affecting path-scoped middleware execution.\nThis vulnerability stems from an inconsistency between how the middie plugin and the underlying Fastify router process request targets.\nSpecifically, the middie plugin evaluates middleware execution based on the raw request target, while the Fastify router resolves absolute-form request targets into standard path formats before dispatching.\nAn unauthenticated network attacker can leverage this discrepancy by crafting requests using an absolute-form target, which causes the application to bypass designated path-scoped middleware.\nThe primary risk implication is the circumvention of security controls, such as authentication and authorization, which are implemented via path-scoped middleware.\nThe vulnerability affects @fastify/middie versions 9.1.0 through 9.3.3.\nExploitation requires no authentication and can be performed remotely over the network, potentially granting attackers unauthorized access to sensitive application routes or administrative endpoints that would otherwise be protected by mandatory middleware checks.",
  "technicalDetails": "The root cause of this vulnerability lies in a mismatch of input normalization between the middie plugin and the Fastify routing engine. Fastify middleware, when configured with path-scoped rules, relies on the middie component to determine whether a given request matches a specific path pattern.\nThe @fastify/middie plugin performs string matching against the 'raw' request target provided by the incoming HTTP request. In contrast, the Fastify router resolves the request target—specifically when provided in absolute-form (e.g., 'http://example.com/protected-path')—into an internal path representation before dispatching the request to the target route handler.\nBecause the two layers evaluate different versions of the URI string, the security policies defined in the middleware are bypassed. When a request is submitted using an absolute-form URI, the middie plugin fails to map the request to the restricted path-scoped middleware, as the raw string does not match the expected relative path pattern. Consequently, the request proceeds to the intended route handler without undergoing the necessary authentication or authorization validation.\nThe attack flow proceeds as follows: 1) An attacker identifies a target endpoint protected by a path-scoped middleware within a Fastify application using a vulnerable version of @fastify/middie. 2) The attacker crafts an HTTP request using an absolute-form URI targeting the protected resource. 3) The middie plugin evaluates the raw request URI and, failing to find a match for the protected path, permits the request to pass through the middleware chain. 4) The Fastify router receives the request, resolves the absolute URI to the internal path, and successfully matches it to the sensitive route handler. 5) The application executes the route handler logic, effectively granting the unauthenticated attacker unauthorized access to protected functionality.\nThis vulnerability is particularly critical for applications relying on middleware for cross-cutting security concerns such as access control lists (ACLs), authentication token verification, or authorization checks. By simply altering the format of the request target, an attacker can neutralize these safeguards, leading to unauthorized data access, administrative command execution, or other unauthorized state changes within the application.\nThe vulnerability is present in @fastify/middie versions >= 9.1.0 and < 9.3.4."
}