@fastify/middie’s use() function improperly concatenates a middleware’s mount path with the plugin’s scope prefix. When the scope prefix ends with a slash, an array mount path is used, or a path is written without a leading slash, the resulting paths can diverge from the path that Fastify’s router serves. In such cases the middleware is silently ignored while the route handler runs, allowing unauthenticated requests to bypass authentication, authorization, or rate‑limiting logic. This flaw is a classic example of a logic error that can be mitigated by correcting the path calculation (CWE‑436).

The vulnerability affects the @fastify/middie package in all releases from 9.0.0 through 9.3.5. Users running versions within this range are subject to the path‑scoped middleware bypass. Versions 9.3.6 and later contain the fix. The package is identified by the entity @fastify/middie.

The assessed CVSS score of 9.1 classifies the issue as critical, indicating a high likelihood of significant impact if exploited. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the described logic flaw, the attack vector is likely an unauthenticated HTTP request directed at any route that relies on path‑scoped middleware. An attacker can easily craft such a request because the bypass occurs automatically when the mount and scope paths are misaligned, requiring no additional privileges. This makes the vulnerability straightforward to exploit in any exposed Fastify application using the affected middie versions.