Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112712— @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

Quick assessment

Affected
@fastify/middie @fastify/middie
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是 Fastify 的类 Express 中间件引擎。在 9.0.0 至 9.3.5 版本中， 函数将路径作用域中间件的挂载路径与插件作用域前缀拼接时，其结果可能与 Fastify 路由器实际处理的路径不一致。这种情况最常见于作用域前缀以斜杠结尾时，同时也可能出现在使用数组形式的挂载路径，或挂载路径未以斜杠开头的情形中。当这两条路径不一致时，中间件会被静默跳过，而路由处理器仍会正常执行，导致认证、授权或速率限制等路径作用域中间件可通过单次未认证请求被绕过。该问题已在 9.3.6 版本中修复，建议用户升级至 9.3.

CVSS 9.1 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112712

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
解释冲突
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/middie @fastify/middie 9.0.0 ~ 9.3.6 -

II. Public POCs for CVE-2026-112712

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112712

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-112712 (1)

IV. Related Vulnerabilities

Same product: @fastify/middie
Same vendor: @fastify/middie
Same weakness: CWE-436

V. Comments for CVE-2026-112712

No comments yet

Leave a comment