GHSA-cxrg-g7r8-w69p
High · 8.4CVSS
8.4
EPSS
—
Published
Jan 20, 2026
CISA due date
—
The record
Fastify Middie Middleware Path Bypass
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fastify/middie | 0 | 9.1.0 |
Related vulnerabilities
- CVE-2026-22031 @fastify/middie is the plugin that adds middleware support on steroids to Fastify. Same vulnerability
- GHSA-72c6-fx6q-fr5w @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes Also affects @fastify/middie
- GHSA-v9ww-2j6r-98q6 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes… Also affects @fastify/middie
- CVE-2026-33804 @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the… Also affects @fastify/middie
- CVE-2026-6270 @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly… Also affects @fastify/middie
- GHSA-8p85-9qpw-fwgw @fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware Also affects @fastify/middie
- CVE-2026-2880 A vulnerability in @fastify/middie versions < 9.2.0 can result in… Also affects @fastify/middie
- CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host… CWE-177