@fastify/middie selects path‑scoped middleware by matching the raw request target, while the Fastify router normalises an absolute‑form request target to a path before dispatching. Because the match strings differ, an attacker can send a request whose request line contains an absolute‑form URL and cause the middleware – for example authentication or authorization – to be skipped while the route handler is executed. The result is that a client can bypass path‑based access controls and gain unauthorized access to data or functionality that should have been protected. This corresponds to CWE‑436 and results in a privilege escalation type of impact.

Affected by the Fastify middleware package @fastify/middie. All releases from version 9.1.0 up to, but excluding, 9.3.4 are vulnerable. Applications built with Fastify that rely on @fastify/middie for authentication or authorization middleware exposed to network traffic are at risk. No other vendors or products are listed.

The vulnerability has a CVSS score of 9.1, indicating high severity. EPSS is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to send an HTTP request with an absolute‑form target to a Fastify server that uses middie; this is usually achievable from any external network client. Because the bypass enables skipping of middleware control, a remote attacker can achieve unauthorized access without needing credentials. Given the high score and the nature of the exploitation path, this vulnerability represents a high‑risk, remote path‑based access‑control bypass.