@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.
When a Fastify application registers authentication middleware (e.g., token or session verification) in a parent scope, and then registers child plugins using @fastify/middie, the library does not propagate this middleware directly to the instances of child plugin engines. As a result, requests directed to routes defined in child scopes are not passed through authentication and authorization mechanisms. An attacker can send an HTTP request without any credentials and gain access to protected resources, bypassing access control.
An unauthenticated attacker can gain access to application resources and functions protected by middleware registered in the parent scope, leading to violations of data confidentiality and integrity.
Update @fastify/middie to version 9.3.2, which contains a fix for this issue. The vendor indicates that no workarounds exist for this vulnerability.
Openjsf @fastify/middie in versions 9.3.1 and earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NFastify Fastify\/middie
APPFastify< 9.3.2
Related vulnerabilities
Fastify/Middie: pominięcie middleware przez zakodowany slash w URL
DoS w @fastify/middie — nieobsłużony wyjątek przy zniekształconych URL powoduje crash procesu
@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ign...
A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when usi...
@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability ex...