The @fastify/middie package, an Express-style middleware engine for Fastify, has a vulnerability in versions 9.0.0 through 9.3.5. The issue arises from how the use() function handles path-scoped middleware's mount path and plugin scope prefix, potentially causing middleware like authentication or rate limiting to be bypassed. This affects systems using @fastify/middie for middleware management.
CVE-2026-85184 @fastify/middie Bypass of Path-Scoped Middleware allows an unauthenticated network attacker to bypass path-based access controls in a Fastify application using @fastify/middie versions >= 9.1.0 and before 9.3.4 due to mismatch in how middleware and the Fastify router evaluate the request target. This vulnerability impacts Fastify application developers and administrators who rely on @fastif [truncated]
