Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@fastify/middie

4 known vulnerabilities (1 critical, 3 high), with the versions each affects and the releases that fix them.

Latest release
9.3.6 (Oct 20, 2026): no advisory affects it
Newest unaffected release
9.3.6 (Oct 20, 2026), the latest release
Advisories
4 · 1 critical, 3 high
Weekly downloads
2.7M
Dependents
157
Releases
22 since 8.0.0 (Jun 6, 2022)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

    Affected: fixed in 9.3.2.

    Fixed in 9.3.2 (released Apr 16, 2026, the day of disclosure).

    The latest release, 9.3.6, is not affected.

    21% of @fastify/middie downloads last week were affected versions (611.8K).

  • CVE-2026-6270Critical 9.1

    @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

    Affected: fixed in 9.3.2.

    Fixed in 9.3.2 (released Apr 16, 2026, the day of disclosure).

    The latest release, 9.3.6, is not affected.

    21% of @fastify/middie downloads last week were affected versions (611.8K).

  • @fastify/middie has an improper path normalization vulnerability

    Affected: fixed in 9.2.0.

    Fixed in 9.2.0 (released Feb 27, 2026, the day of disclosure).

    The latest release, 9.3.6, is not affected.

    21% of @fastify/middie downloads last week were affected versions (605.2K).

  • Fastify Middie Middleware Path Bypass

    Affected: fixed in 9.1.0.

    Fixed in 9.1.0 (released Jan 3, 2026, 16 days before disclosure).

    The latest release, 9.3.6, is not affected.

    21% of @fastify/middie downloads last week were affected versions (598.7K).