'@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.

A security vulnerability exists in @fastify/middie versions >= 9.1.0 and before 9.3.4 that allows unauthenticated attackers to bypass path-based access controls. The flaw arises because the middleware matches against raw request targets while the Fastify router resolves absolute-form request targets to their paths before dispatching. This mismatch means requests using absolute-form targets reach route handlers while skipping path-scoped middleware such as authentication and authorization checks. An unauthenticated network attacker can exploit this to circumvent access controls in Fastify applications relying on middie for security enforcement. The vulnerability poses a significant risk to applications using affected versions for access control. The fix is available in @fastify/middie version 9.3.4 or later, and users are strongly advised to upgrade immediately.