CyberRota Analysis
AI-GeneratedVersions of @fastify/middie from 9.1.0 to 9.3.4 are vulnerable to a critical flaw that allows unauthenticated attackers to bypass path-based access controls, potentially leading to unauthorized access in Fastify applications. This occurs due to a mismatch in how raw request targets are evaluated between middleware and the Fastify router, allowing requests to circumvent essential security checks. Organizations utilizing Fastify with the affected middie versions should prioritize upgrading to 9.3.4 or later to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.