The vulnerability is an improper path normalization flaw in @fastify/middie that allows crafted request paths to bypass authentication and authorization checks when path‑scoped middleware is used. Attackers can request a protected path such as '/secret' while the middleware is skipped, giving them unintended access. The weakness is classified as CWE‑20, which reflects improper input validation.

Affected versions are all releases of @fastify/middie earlier than 9.2.0. The product is maintained by OpenJSF and is used by applications built on the Fastify framework. Any deployment that relies on path‑scoped middleware with router normalization enabled is susceptible.

The flaw has a CVSS score of 8.2, indicating high severity, but the EPSS score is less than 1% so exploitation is still considered unlikely at present. It is not listed in CISA's Known Exploited Vulnerabilities catalog. The attack vector requires an HTTP client that can control the request path; if router normalization options such as ignoreDuplicateSlashes or useSemicolonDelimiter are enabled, a crafted URL can trick the router into handling the request without executing the middleware.