{"id":"CVE-2026-112712","aliases":[],"cve":{"records":[{"id":"CVE-2026-112712","source":"openjs","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-19T17:43:39.048Z","published":"2026-10-20T20:43:48.681Z","modified":"2026-10-30T17:17:28.727Z"}],"publishers":[{"name":"openjs","role":"CNA","organizationId":"ce714d77-add3-4f53-aff5-83d477b104bb","modified":"2026-10-20T20:43:48.681Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:17:28.727Z"}],"references":[{"url":"https://github.com/fastify/middie/security/advisories/GHSA-5p92-8765-9fv8","tags":[],"source":"openjs"},{"url":"https://cna.openjsf.org/security-advisories.html","tags":[],"source":"openjs"}],"weaknesses":[{"id":"CWE-436","description":"CWE-436: Interpretation Conflict","source":"openjs"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T15:48:29.631546Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch","titleSource":"openjs","descriptionSource":"openjs","description":"@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request.","score":9.1,"severity":"critical","published":"2026-10-20T20:43:48.681Z","modified":"2026-10-30T17:17:28.727Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"@fastify/middie","name":"@fastify/middie","platforms":[],"versions":[{"version":"9.0.0","status":"affected","lessThan":"9.3.6","versionType":"semver"},{"version":"9.3.6","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/@fastify/middie","packageIdentity":{"ecosystem":"npm","name":"@fastify/middie"},"cpes":[],"source":"openjs","url":"https://www.cve.org/CVERecord?id=CVE-2026-112712"}],"remediation":[],"references":["https://github.com/fastify/middie/security/advisories/GHSA-5p92-8765-9fv8","https://cna.openjsf.org/security-advisories.html"],"sources":[{"name":"CVE","id":"CVE-2026-112712","modified":"2026-10-30T17:17:28.727Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-112712"}],"assessments":[{"source":"openjs","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}],"sourceAffected":[],"observedAt":"2026-10-30T19:26:22.969Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T04:10:31.776Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}