@fastify/middie vulnerabilities

CVEs whose affected-version data names the @fastify/middie package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-112712Critical· 9.1

yesterday

@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the pat…

▾ Midnight@fastify/middie · @fastify/middievia CVEORG