CVE-2026-112712: Fastify Middie Auth Bypass Vulnerability

CVE-2026-112712 Overview

CVE-2026-112712 is a middleware bypass vulnerability in @fastify/middie, the Express-style middleware engine for Fastify. The flaw affects versions 9.0.0 through 9.3.5 and stems from inconsistent path joining in the use() function. When a plugin scope prefix ends in a slash, when array mount paths are supplied, or when mount paths omit a leading slash, the mount path computed by middie diverges from the path Fastify's router actually serves. The middleware is silently skipped while the route handler continues to execute. Attackers can bypass authentication, authorization, or rate limiting with a single unauthenticated HTTP request.

Critical Impact

Path-scoped middleware enforcing authentication, authorization, or rate limiting can be bypassed with one crafted request, exposing protected routes to unauthenticated callers.

Affected Products

• @fastify/middie versions 9.0.0 through 9.3.5
• Fastify applications that register path-scoped middleware via use() with a mount path
• Applications using plugin scope prefixes ending in /, array mount paths, or mount paths without a leading slash

Discovery Timeline

• 2026-10-20 - CVE-2026-112712 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-112712

Vulnerability Analysis

The vulnerability is an interpretation conflict between two components ([CWE-436]) that resolve URL paths independently. @fastify/middie composes the final mount path for middleware by joining the plugin scope prefix with the user-supplied mount path. Fastify's router performs its own path normalization when matching incoming requests. When the two routines produce different canonical paths, the router still dispatches the request to the handler, but middie fails to match the middleware against the stored mount path and skips execution.

The divergence occurs reliably in three scenarios: a scope prefix that ends with a trailing slash, a mount path provided as an array, and a mount path written without a leading slash. In each case, the middleware chain intended to run before the handler is silently omitted. Security logic implemented as middleware, such as session validation, role checks, or request throttling, never runs, while the business handler responds normally.

Root Cause

The root cause is an inconsistent interpretation of mount path strings between @fastify/middie's use() function and Fastify's router. The middleware engine's path join logic does not normalize trailing slashes, array inputs, or missing leading slashes to match the canonical form that the router produces during route registration and request dispatch.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to the application. An attacker issues a standard HTTP request to a route whose protection relies on a path-scoped middleware registered under a vulnerable prefix pattern. Because the router accepts the request but middie skips the middleware, the protected handler executes without the intended checks. See the GitHub Security Advisory GHSA-5p92-8765-9fv8 for the full technical description.

Detection Methods for CVE-2026-112712

Indicators of Compromise

• Successful HTTP responses on routes protected by path-scoped middleware that have no corresponding authentication or authorization log entries
• Access log entries for protected endpoints without matching middleware log output (for example, missing audit, session, or rate-limit log lines)
• Spikes in 2xx responses to sensitive endpoints originating from unauthenticated clients

Detection Strategies

• Inventory all registrations of @fastify/middie and audit use() calls that specify a mount path, flagging scope prefixes ending in /, array mount paths, and paths without a leading slash
• Compare application dependency manifests (package.json, package-lock.json) against the fixed version 9.3.6 to identify vulnerable deployments
• Add integration tests that assert path-scoped middleware executes for every protected route, failing closed if the middleware is skipped

Monitoring Recommendations

• Correlate web server access logs with middleware audit logs to detect handler execution without the preceding middleware stage
• Alert on authenticated-only endpoints returning 2xx responses to requests lacking valid session or token headers
• Track dependency drift for @fastify/middie across build pipelines and container images to catch regressions below 9.3.6

How to Mitigate CVE-2026-112712

Immediate Actions Required

• Upgrade @fastify/middie to version 9.3.6 or later across all affected services
• Audit every use() call and normalize mount paths to begin with / and avoid trailing slashes in scope prefixes
• Move authentication and authorization enforcement from path-scoped middleware into a Fastify preHandler hook that runs after route resolution

Patch Information

The issue is fixed in @fastify/middie9.3.6. The patch aligns the mount path computed by use() with the canonical path produced by Fastify's router so that path-scoped middleware executes consistently. Review the GitHub Security Advisory GHSA-5p92-8765-9fv8 and the OpenJS Foundation Security Advisories for release details.

Workarounds

• Enforce authorization inside a Fastify preHandler hook, which runs after the router has resolved the request and is unaffected by the middie path mismatch
• Avoid declaring scope prefixes that end with / and always register mount paths as strings with a leading /
• Remove array-form mount paths and replace them with individual use() registrations until the upgrade is complete

# Configuration example
npm install @fastify/middie@^9.3.6
npm ls @fastify/middie