External risk intelligence

@fastify/middie Path Discrepancy Bypasses Middleware

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-112712

@fastify/middie is a middleware engine used in web applications to handle routing, authentication, and authorization. Because it is a core component of web server logic exposed to incoming network requests, applications using this middleware are commonly deployed as internet-facing web services or APIs where route handling and middleware execution are standard functions.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

@fastify/middie, a middleware engine for Fastify web applications, contains a critical vulnerability that could allow unauthenticated requests to bypass security controls like authentication and rate limiting. This occurs when the middleware's configured path does not align with the router's path, leading to the middleware being silently skipped while the route handler still executes. The issue is resolved in version 9.3.6 and later.

Security checks can be bypassed by web requests.
Essential for confirming if your web applications are exposed.
Mitigate risk by verifying use and upgrading middleware.

Attack Path

How an attacker could exploit the issue

An attacker could bypass path-scoped middleware, like authentication or authorization checks, by sending a specially crafted unauthenticated request. This occurs because the middleware engine incorrectly combines path segments, causing the middleware to be skipped while the intended route handler still executes. This bypass could allow an attacker to access sensitive functionality.

No authentication required.
Triggered by sending a request.
Bypasses security middleware.

Live Threat

Current exploitation, exposure, and threat context

Path-scoped middleware, such as authentication, authorization, or rate limiting, could be bypassed by unauthenticated requests when the @fastify/middie library incorrectly joins mount paths. This could occur when the scope prefix ends in a slash, or for array and non-leading slash mount paths, allowing direct access to route handlers while silently skipping these security controls.

Unprotected routes could be accessed.
Requests could bypass security middleware.
Unauthorized access to application features.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in @fastify/middie could allow unauthenticated requests to bypass security controls like authentication and authorization. Platform or application teams responsible for Fastify deployments should first identify all instances of the affected middleware, confirm their exposure and criticality, and then plan remediation. As a workaround, security checks can be implemented in Fastify hooks that execute after routing.

Platform/Application teams should own the issue.
Verify affected middleware instances and exposure.
Plan remediation or implement workaround hooks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is @fastify/middie?

@fastify/middie is a middleware engine for the Fastify web framework. Developers use it to manage HTTP request processing—such as running authentication, authorization, or rate-limiting logic—before a final route handler executes. It enables modular control over how web applications handle incoming data, ensuring that specific security or functional steps occur consistently for defined URL paths.

What does CVE-2026-112712 mean?

This CVE describes a path discrepancy flaw, categorized as CWE-436 (Interpretation Conflict). It occurs when the middleware incorrectly calculates the path for a request, causing it to misalign with the Fastify router. Consequently, the middleware engine believes the request does not match the protected path and silently skips it, even though the main route handler still runs, effectively neutralizing security controls like authentication.

How is this vulnerability triggered?

An attacker triggers this by sending a crafted request to a route protected by scoped middleware. The bug specifically manifests when the middleware mount path is defined in ways that confuse the engine, such as ending in a slash, using array paths, or omitting a leading slash. Standard, well-formed paths that do not share these specific structural complexities are less likely to experience this exact path-matching divergence.

Why should I care about this risk?

According to Halo Surface Signal, this component is commonly deployed in internet-facing web services and APIs. If your application uses affected versions of @fastify/middie to enforce security, attackers can reach sensitive endpoints without passing through your authentication or authorization logic. Because the middleware is skipped silently, the application will process the request as if it were legitimate, potentially exposing private data or restricted features.

How do I fix this in my application?

The primary resolution is to upgrade @fastify/middie to version 9.3.6 or later. If an immediate upgrade is not feasible, you can apply a workaround by moving critical security checks into Fastify hooks, such as preHandler. These hooks run after the router has finished resolving the request, ensuring that the security logic executes reliably regardless of how the middleware path was originally mounted.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.