CVE-2026-112712: falha crítica em @fastify/middie
@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.3%
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
@fastify/middie · @fastify/middieCVEs relacionadas — @fastify/middie
No mesmo produto, das mais perigosas para as menos.
CVE-2026-85184CRITICAL@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request targetEPSS 0.5%CVE-2026-14198CRITICAL@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter valuesEPSS 0.5%CVE-2026-14181HIGH@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded pathsEPSS 0.5%CVE-2026-6270CRITICAL@fastify/middie vulnerable to middleware authentication bypass in child plugin scopesEPSS 0.5%CVE-2026-2880HIGH@fastify/middie has an improper path normalization vulnerabilityEPSS 0.4%CVE-2026-33804HIGH@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes optionEPSS 0.3%