@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

@fastify/middie is the Express-compatibility shim that lets Fastify apps run classic app.use('/admin', authMiddleware) style middleware. The bug: middie matches the middleware's path prefix against req.url in its raw, undecoded form, while Fastify's underlying router decodes percent-encoded characters before dispatching to the route handler. An attacker who requests /%61dmin/users sees middie's regex fail to match /admin, so the auth middleware is skipped — but Fastify's router happily decodes and routes to the protected /admin/users handler. Affected versions are @fastify/middie ≤ 9.0.3; patched in 9.1.0. The pattern also extends beyond the letter-encoding trick: encoded slashes (%2F) inside path parameter values can produce the same canonicalization drift.

Vendor-labeled CRITICAL 9.1 (AV:N/AC:L/PR:N/UI:N) is overstated for a library-level flaw whose exploitability is entirely gated on a specific usage pattern. The upstream GHSA-cxrg-g7r8-w69p actually scored this 8.4 HIGH with AC:H and PR:L, which is closer to reality. When apps *do* use middie for path-scoped auth, this is a full unauthenticated bypass and deserves HIGH. When they use Fastify hooks (onRequest, preHandler) — the idiomatic Fastify pattern — middie is not in the auth path and the CVE is inert.

Why this verdict

• Usage-pattern gated: The bypass requires @fastify/middie to be the enforcement point for auth. Fastify's own docs steer authors toward onRequest/preHandler hooks; middie is primarily a compatibility layer. Only apps that violate the idiom are vulnerable — this narrows the exposed population well below the vendor's implicit AC:L/PR:N population.
• Edge normalization mitigates for most enterprises: Reverse proxies (nginx, HAProxy, Cloudflare, AWS ALB) and mature WAFs decode or reject percent-encoded ASCII in path segments before Fastify sees the request. Enterprises running Fastify directly on 0.0.0.0:3000 without a proxy are the minority.
• Role multiplier — application-tier library: middie sits inside line-of-business Node services (typical role). It is not a domain controller, hypervisor, IdP, PAM, backup, or kernel-mode agent. Worst-case blast radius per compromised app: tenant/app scope, not fleet or identity-plane. This sets the floor at HIGH, not CRITICAL.
• Trivial to weaponize when applicable: Where the pattern exists, exploitation is a single curl with %XX-encoded characters — no auth, no chained conditions, no user interaction. That is what keeps this at HIGH rather than MEDIUM.
• Not on KEV, no observed campaigns, but PoC is public and trivial. Mass scanning is plausible once someone bundles it into nuclei templates.

Why not higher?

CRITICAL is reserved for defaults-vulnerable primitives or high-value-role components (IdP, hypervisor, backup, kernel-mode agent). middie is a mid-tier application library, and the vulnerable code path is a non-idiomatic usage pattern rather than a default. Even where exploited, the blast radius stops at the compromised Node service — no fleet pivot, no identity-plane compromise.

Why not lower?

MEDIUM would understate an unauthenticated remote auth bypass with a trivially weaponized PoC and no user interaction. When the vulnerable pattern is present, this is a complete bypass — not a partial info leak. The presence of public PoC by a known researcher and the ease of nuclei-template weaponization keep it firmly at HIGH.

1. Upgrade @fastify/middie to ≥ 9.1.0 (prefer 9.2.0) — The 9.1.0 patch normalizes req.url before the path-to-regexp match, aligning middie's view of the path with Fastify's router. 9.2.0 additionally hardens duplicate-slash handling from a sibling GHSA. Deploy within 30 days per the noisgate HIGH mitigation SLA.
2. Reject percent-encoded ASCII letters at the edge — Add an nginx/HAProxy/WAF rule to return 400 for paths containing %XX sequences that decode to [A-Za-z] or %2F. This kills the bypass primitive regardless of middie version. Cloudflare Managed Rules and ModSecurity CRS 942 rulesets can do this out of the box.
3. Move auth off middie onto Fastify hooks — Refactor app.use('/admin', authMiddleware) into fastify.addHook('onRequest', authFn) scoped via fastify.register with a prefix. Fastify hooks execute inside the router post-decoding and are not vulnerable to the drift. This is the idiomatic pattern and eliminates the class of bug, not just this CVE.
4. Add handler-side identity assertion — Inside every protected handler, assert request.user (or equivalent context) is populated and fail closed if not. This is defense-in-depth against *any* middleware bypass, including future middie CVEs.
5. Deploy SIEM rule for 2xx on admin paths without prior auth event — Correlate access-log 2xx responses on /admin/*, /internal/* prefixes against auth-log entries in the same session/JWT. Any 2xx without a corresponding successful auth is a bypass indicator.

Run on any host with node and npm installed against a checkout of the target Node.js application. Invoke with the project root as argument: ./check-middie.sh /path/to/app. No elevated privileges required — reads package-lock.json and node_modules only.

#!/usr/bin/env bash
# noisgate: CVE-2026-14198 / GHSA-cxrg-g7r8-w69p checker for @fastify/middie
# Usage: ./check-middie.sh <path-to-node-project>
set -u

APP_DIR="${1:-.}"
FIXED_MAJOR=9
FIXED_MINOR=1
FIXED_PATCH=0

if [ ! -d "$APP_DIR" ]; then
  echo "UNKNOWN: directory $APP_DIR not found"
  exit 2
fi
cd "$APP_DIR" || { echo "UNKNOWN: cannot cd"; exit 2; }

# 1. Is middie even in the tree?
if [ ! -f "package-lock.json" ] && [ ! -f "pnpm-lock.yaml" ] && [ ! -f "yarn.lock" ]; then
  echo "UNKNOWN: no lockfile in $APP_DIR"
  exit 2
fi

VER=""
if [ -d "node_modules/@fastify/middie" ]; then
  VER=$(node -p "require('./node_modules/@fastify/middie/package.json').version" 2>/dev/null)
fi
if [ -z "$VER" ] && command -v npm >/dev/null 2>&1; then
  VER=$(npm ls @fastify/middie --depth=99 --json 2>/dev/null | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);const walk=n=>{if(!n)return;if(n.dependencies){for(const[k,v]of Object.entries(n.dependencies)){if(k==='@fastify/middie'&&v.version){console.log(v.version);process.exit(0)}walk(v)}}};walk(j)}catch(e){}})" )
fi

if [ -z "$VER" ]; then
  echo "PATCHED: @fastify/middie not present in dependency tree"
  exit 0
fi

# 2. semver compare
IFS='.' read -r MA MI PA <<< "${VER%%-*}"
if [ "$MA" -gt "$FIXED_MAJOR" ] \
  || { [ "$MA" -eq "$FIXED_MAJOR" ] && [ "$MI" -gt "$FIXED_MINOR" ]; } \
  || { [ "$MA" -eq "$FIXED_MAJOR" ] && [ "$MI" -eq "$FIXED_MINOR" ] && [ "$PA" -ge "$FIXED_PATCH" ]; }; then
  echo "PATCHED: @fastify/middie $VER >= 9.1.0"
  exit 0
fi

# 3. Check if middie is used for path-scoped auth (heuristic)
USAGE=$(grep -rEn "\\.use\\(['\"]/[^'\"]+['\"]" --include='*.js' --include='*.ts' --include='*.mjs' -- . 2>/dev/null | grep -v node_modules | head -5)

echo "VULNERABLE: @fastify/middie $VER (fix: >= 9.1.0)"
if [ -n "$USAGE" ]; then
  echo "  Path-scoped .use() calls detected — likely exploitable pattern:"
  echo "$USAGE" | sed 's/^/    /'
fi
exit 1

Sources

1. GHSA-cxrg-g7r8-w69p — Fastify Middie Middleware Path Bypass
2. GHSA-8p85-9qpw-fwgw — Improper path normalization in middie
3. GHSA-v9ww-2j6r-98q6 — middie bypass via ignoreDuplicateSlashes
4. GHSA-6hw5-45gm-fj88 — Sibling advisory in @fastify/express
5. GitLab Advisory Database — @fastify/middie path normalization
6. OpenJS Foundation CNA — Security Advisories
7. OSV — GHSA-8p85-9qpw-fwgw
8. Fastify Hooks docs (idiomatic auth pattern)