| Package | Affected versions | Patched versions |
|---|---|---|
| fastify/middie | < 9.2.0 | 9.2.0 |
| @fastify/middie | < 9.2.0 | 9.2.0 |
A path normalization inconsistency in @fastify/middie can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)).
When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.
An unauthenticated remote attacker can access endpoints intended to be protected by middleware-based auth/authorization controls by sending specially crafted URL paths (for example, //secret or /secret;foo=bar), depending on router option configuration.
This may lead to unauthorized access to protected functionality and data exposure.
@fastify/[email protected]The issue is caused by canonicalization drift between:
@fastify/middie path matching for app.use('/prefix', ...), andBecause middleware and router did not always evaluate the same normalized path, auth middleware could be skipped while route resolution still succeeded.
Until patched version is deployed:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free