CVE-2026-112712

Deferred Deferred - Pending Action

Path Traversal in Fastify Middie Middleware

Publication date: 2026-10-20

Last updated on: 2026-10-30

Assigner: openjs

Description

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-112712

Affected Vendors & Products

Vendor	Product	Version / Range
@fastify/middie	@fastify/middie	9.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

This vulnerability affects @fastify/middie versions 9.0.0 through 9.3.5. It involves the use() function incorrectly joining a path-scoped middleware's mount path to the plugin scope prefix. This can cause middleware to be skipped while route handlers still execute, potentially bypassing security measures like authentication or authorization.

Detection Guidance

This vulnerability is specific to the @fastify/middie library and cannot be detected via network scanning or system commands. Instead, check the installed version of @fastify/middie in your project using npm list @fastify/middie or grep the package.json file for the version. If the version is between 9.0.0 and 9.3.5, the system is vulnerable.

Impact Analysis

An attacker could exploit this to bypass security checks such as authentication, authorization, or rate limiting. This could allow unauthorized access to protected routes or resources, even if the application appears to enforce these checks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. Organizations using affected versions may fail audits or face penalties due to insufficient access controls.

Mitigation Strategies

Upgrade @fastify/middie to version 9.3.6 or later immediately. If upgrading is not possible, enforce authorization in a Fastify hook such as preHandler to ensure middleware like authentication or rate limiting runs after the router resolves the request.

Hi! I’m here to help you understand CVE-2026-112712. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...