Fastify middleware flaw skips auth checks for unauthenticated requests

A critical vulnerability in the @fastify/middie middleware engine allows attackers to bypass authentication, authorization, and rate limiting controls. According to the National Vulnerability Database record for CVE-2026-112712, this flaw impacts versions from 9.0.0 through 9.3.5. The issue arises when the middleware’s calculated mount path diverges from the path Fastify’s router actually serves, causing security checks to be silently ignored.

How does the path resolution flaw bypass security controls?

The @fastify/middie engine joins a path-scoped middleware’s mount path to the plugin scope prefix in a way that can mismatch the router’s expectations. This divergence most often occurs when the scope prefix ends in a slash, or when using array mount paths and paths written without a leading slash. When these two paths disagree, the middleware is skipped entirely.

What happens to the request when middleware is skipped?

Although the path-scoped middleware is bypassed, the route handler still runs as intended. This means an attacker can send a single unauthenticated request that successfully reaches the application logic. Security measures such as authentication checks, authorization verification, and rate limiting are effectively disabled for those specific requests, granting unauthorized access.

Is there a fix for CVE-2026-112712?

Yes, the issue is fixed in @fastify/middie version 9.3.6. Users are advised to upgrade to 9.3.6 or later to resolve the vulnerability. If immediate upgrading is not possible, a workaround exists: enforce authorization in a Fastify hook such as preHandler, which runs after the router has resolved the request, ensuring checks occur regardless of middleware path resolution.

What analysts watch for

Teams usually monitor for unexpected authentication bypasses where requests reach route handlers without passing middleware. Analysts should examine server logs for successful responses to requests that lack valid credentials, particularly on endpoints with path prefixes ending in slashes. Review middleware configuration for array mounts or missing leading slashes. Check whether authorization logic relies solely on path-scoped middleware rather than global hooks. Inspect network traffic for patterns indicating repeated unauthorized access attempts to sensitive routes.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: @fastify/middie

• Upgrade @fastify/middie to version 9.3.6 or later as soon as possible
• Implement authorization checks in Fastify hooks like preHandler as a temporary workaround
• Review middleware configurations for path prefixes ending in slashes or missing leading slashes
• Monitor server logs for successful unauthenticated requests to sensitive endpoints

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of @fastify/middie are affected by CVE-2026-112712?

Versions from 9.0.0 through 9.3.5 are affected by this critical vulnerability.

What is the CVSS score for CVE-2026-112712?

The National Vulnerability Database rates CVE-2026-112712 as Critical with a CVSS score of 9.1.

Does the route handler still execute when middleware is bypassed?

Yes, the route handler continues to run even when path-scoped middleware is silently skipped.