How does CVE-2026-112712 in Fastify middie 9.0-9.3.5 silently skip auth checks?

The @fastify/middie package, which serves as the Express-style middleware engine for the Fastify web framework, contains a critical vulnerability that allows attackers to bypass security controls. According to the National Vulnerability Database, the flaw exists in versions 9.0.0 through 9.3.5. It enables unauthenticated requests to reach route handlers while skipping path-scoped middleware such as authentication, authorization, or rate limiting.

How does the path resolution error work?

The vulnerability stems from how the `use()` function joins a path-scoped middleware's mount path to the plugin scope prefix. The NVD record states that this joining process can diverge from the path Fastify's router actually serves. This mismatch most often occurs when the scope prefix ends in a slash. It also happens for array mount paths and for mount paths written without a leading slash.

Why is this bypass dangerous for developers?

When the calculated middleware path and the router path disagree, the middleware is silently skipped. The route handler still runs, but the protective layer does not. According to the source material, this means a single unauthenticated request can bypass security checks. Developers relying on path-scoped middleware for access control may believe their endpoints are protected when they are not.

Is there a fix for this issue?

Yes, the issue is fixed in @fastify/middie version 9.3.6. Users should upgrade to 9.3.6 or later to resolve the vulnerability. The NVD record confirms that this version addresses the path divergence problem. Until an upgrade is possible, a workaround exists. Developers can enforce authorization in a Fastify hook such as `preHandler`. This hook runs after the router has resolved the request, avoiding the path mismatch.

What comes next for affected applications?

Teams using Fastify should immediately audit their middleware configurations. The National Vulnerability Database assigns this flaw CWE-436, indicating a partial path traversal weakness. With a CVSS score of 9.1, the threat is rated Critical. Applications using @fastify/middie before 9.3.6 are affected. Upgrading is the primary recommendation. If immediate upgrades are not feasible, implementing the `preHandler` workaround is essential to maintain security posture.

What analysts watch for

Security teams usually examine server logs for requests that reach route handlers without corresponding authentication middleware execution. Analysts check whether path-scoped middleware is being skipped for specific URL patterns. They look for anomalies in access patterns, such as unauthenticated users accessing protected resources. Teams review middleware configuration files for array mount paths or prefixes ending in slashes. They verify that security controls are enforced at the router level rather than relying solely on path-scoped middleware.

Background: CVSS score

The CVSS score provides a standardized number to rank vulnerability severity. Small teams should use it to prioritize patches, but must adjust for business context. A high score does not always mean immediate danger if the affected component is isolated or unused.

Read the full guide: CVSS Scores Explained: What Small Teams Must Know

What to do and how to stay safe: Fastify

• Upgrade @fastify/middie to version 9.3.6 or later as soon as possible.
• Implement authorization checks in a Fastify `preHandler` hook as a temporary workaround.
• Audit middleware configurations to identify path-scoped middleware that may be skipped.
• Monitor server logs for unauthenticated access to protected routes.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of @fastify/middie are affected by CVE-2026-112712?

Versions from 9.0.0 through 9.3.5 are affected by this vulnerability.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-112712 with a CVSS score of 9.1, which is Critical.

How can developers mitigate this issue before upgrading?

Developers can enforce authorization in a Fastify hook such as `preHandler` that runs after the router has resolved the request.