Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact @fastify/middie v9.3.1 and earlier incorrectly re-prefixes middleware paths when propagating them to child plugin scopes. When a child plugin is registered with a prefix that overlaps with a parent-scoped middleware path, the middleware path is modified during inheritance and silently fails to match incoming requests. This results in complete bypass of middleware security controls for all routes defined within affected child plugin scopes, including nested (grandchild) scopes. Authentication, authorization, rate limiting, and any other middleware-based security mechanisms are skipped. No special request crafting or configuration is required. This is the same vulnerability class as GHSA-hrwm-hgmj-7p9c (CVE-2026-33807) in @fastify/express. Patches Upgrade to @fastify/middie v9.3.2 or later. Workarounds None. Upgrade to the patched version.
Recommended action: Upgrade to 9.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact @fastify/middie v9.3.1 and earlier does not read the deprecated (but still functional) top-level ignoreDuplicateSlashes option, only reading from routerOptions. This creates a normalization gap: Fastify's router normalizes duplicate slashes but middie does not, allowing middleware bypass via URLs with duplicate leading slashes (e.g., //admin/secret). This only affects applications using the deprecated top-level configuration style (fastify({ ignoreDuplicateSlashes: true })). Applications using routerOptions: { ignoreDuplicateSlashes: true } are not affected. This is distinct from GHSA-8p85-9qpw-fwgw (CVE-2026-2880), which was patched in v9.2.0. Patches Upgrade to @fastify/middie = 9.3.2. Workarounds Migrate from deprecated top-level ignoreDuplicateSlashes: true to routerOptions: { ignoreDuplicateSlashes: true }.
Recommended action: Upgrade to 9.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A path normalization inconsistency in @fastify/middie can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)). When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers. Impact An unauthenticated remote attacker can access endpoints intended to be protected by middleware-based auth/authorization controls by sending specially crafted URL paths (for example, //secret or /secret;foo=bar), depending on router option configuration. This may lead to unauthorized access to protected functionality and data exposure. Affected versions - Confirmed affected: @fastify/middie@9.1.0 - All versions prior to the patch are affected. Patched versions - Fixed in: 9.2.0 Details The issue is caused by canonicalization drift between: 1.…
Recommended action: Upgrade to 9.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A security vulnerability exists in @fastify/middie where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., /%61dmin instead of /admin). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Details The vulnerability is caused by how middie matches requests against registered middleware paths. 1. Regex Generation: When fastify.use('/admin', ...) is called, middie uses path-to-regexp to generate a regular expression for the path /admin. 2. Request Matching: For every request, middie executes this regular expression against req.url (or req.originalUrl). 3. The Flaw: req.url in Fastify contains the raw, undecoded path string. The generated regex expects a decoded path (e.g., /admin). If a request is sent to /%61dmin, the regex…
Recommended action: Upgrade to 9.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.