CVE WATCH / VULNERABILITY DETAIL
CVE-2026-112712
CRITICALCVSS 9.1NVD feed
Published 20 October 2026 · tracked since 21 October 2026
Description
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix end
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog