CVE-2026-112712

The @fastify/middie middleware engine for Fastify (versions 9.0.0 through 9.3.5 ) is vulnerable to a path-scoped middleware bypass . The use() function incorrectly joins mount paths with plugin scope prefixes, specifically when the prefix ends in a slash, contains array mount paths, or lacks a le...

CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...