Fastify Middie Middleware Path Bypass Vulnerability

@fastify/middie, the Express-style middleware engine for Fastify, has a middleware path bypass vulnerability in versions 9.0.0 through 9.3.5.

The use() function joins a path-scoped middleware's mount path to the plugin scope prefix in a way that can diverge from the path Fastify's router serves. When the two paths disagree, the middleware is silently skipped while the route handler still runs, so path-scoped middleware such as authentication, authorization, or rate limiting can be bypassed by a single unauthenticated request.

• Affected versions: 9.0.0 through 9.3.5
• Most common trigger: scope prefix ending in a slash
• Also affected: array mount paths and mount paths without a leading slash
• Fixed in: 9.3.6 or later
• Workaround: enforce authorization in a Fastify hook such as preHandler after the router resolves the request