@anarchitects/auth-nest (>=0.0.1, <=3.0.1), @arenahito/droid-webscr (>=0.2.1, <=0.6.1) +77 more potentially affected by CVE-2026-112712 via @fastify/middie (>=9.0.2, <=9.3.5)

@fastify/middie NPM version =9.0.2, =0.0.1, =0.2.1, =0.1.0, =1.6.1, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.73 and more Source cves: CVE-2026-112712 Source advisory: SNYK:JS-FASTIFYMIDDIE-21431600...

Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via incorrect prefix-path joining in the use function, where middleware mount paths are concatenated with the Fastify route prefix using a logic that diverges fr...

CVE-2026-112712

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

CVE-2026-112712

The @fastify/middie middleware engine for Fastify (versions 9.0.0 through 9.3.5 ) is vulnerable to a path-scoped middleware bypass . The use() function incorrectly joins mount paths with plugin scope prefixes, specifically when the prefix ends in a slash, contains array mount paths, or lacks a le...

CVE-2026-112712

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

EUVD-2026-105361

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

@anarchitects/auth-nest (>=0.0.1, <=3.0.1), @arenahito/droid-webscr (>=0.2.1, <=0.6.1) +77 more potentially affected by CVE-2026-112712 via @fastify/middie (>=9.0.2, <=9.3.5)

@fastify/middie NPM version =9.0.2, =0.0.1, =0.2.1, =0.1.0, =1.6.1, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.73 and more Source cves: CVE-2026-112712 Source advisory: MEND:CVE-2026-112712...

CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

PT-2026-118649

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.0.0 through 9.3.5 Description The use function joins a path-scoped middleware mount path to the plugin scope prefix in a manner that may diverge from the path served by the Fastify router. This occurs primarily when...

@fastify/middie: Processing logic error vulnerability

The @fastify/middie version from 9.0.0 to 9.3.5 contains a processing logic vulnerability. This vulnerability arises from the use function, which may deviate from the path provided by the Fastify router when concatenating the mount path of the middleware with the plugin scope prefix. As a result,...

Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via the request target evaluation. An attacker can gain unauthorized access to protected routes by crafting requests with absolute-form targets that bypass...

@arenahito/droid-webscr (>=0.2.1, <=0.6.1), @cappa/cli (>=0.4.4, <=0.12.0) +3 more potentially affected by CVE-2026-85184 via @fastify/middie (>=9.1.0, <=9.3.3)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0, =1.0.0-alpha.23, =1.0.0-alpha.29 Source cves: CVE-2026-85184 Source advisory: SNYK:JS-FASTIFYMIDDIE-19643570...

CVE-2026-85184

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

EUVD-2026-70979

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-85184

@fastify/middie (a Fastify plugin for HTTP middleware) versions 9.1.0 through 9.3.3 are affected by a path-scoped middleware bypass. The root cause is a mismatch: middie evaluates the raw request target to decide whether to run path-scoped middleware, while the Fastify router resolves an absolute...

CVE-2026-85184

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

@arenahito/droid-webscr (>=0.2.1, <=0.6.1), @cappa/cli (>=0.4.4, <=0.12.0) +3 more potentially affected by CVE-2026-85184 via @fastify/middie (>=9.1.0, <=9.3.3)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0, =1.0.0-alpha.23, =1.0.0-alpha.29 Source cves: CVE-2026-85184 Source advisory: MEND:CVE-2026-85184...

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...