https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:48:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-273741 EUVD-2026-273741 https://cve.radiocsirt.org/vuln/euvd-2026-273741 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2880 <p>A vulnerability in @fastify/middie versions &lt; 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use(&#39;/secret&#39;, auth)).</p> <p>When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.</p> <p>A vulnerability in @fastify/middie versions &lt; 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use(&#39;/secret&#39;, auth)).</p> <p>When Fastify router normalization options are enabled (such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-2880 https://cve.radiocsirt.org/vuln/ghsa-8p85-9qpw-fwgw <p><strong>Affected:</strong> npm: @fastify/middie</p> <p>## Summary A path normalization inconsistency in `@fastify/middie` can result in authentication/authorization bypass when using path-scoped middleware (for example, `app.use(&#39;/secret&#39;, auth)`).</p> <p>When Fastify router normalization options are enabled (such as `ignoreDuplicateSlashes`, `useSemicolonDelimiter`, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.</p> <p>## Impact An unauthenticated remote attacker can access endpoints intended to be protected by middleware-based auth/authorization controls by sending specially crafted URL paths (for example, `//secret` or `/secret;foo=bar`), depending on router option configuration.</p> <p>This may lead to unauthorized access to protected functionality and data exposure.</p> <p>## Affected versions - Confirmed affected: `@fastify/middie@9.1.0` - All versions prior to the patch are affected.</p> <p>## Patched versions - Fixed in: *9.2.0*</p> <p>## Details The issue is caused by canonicalization drift between: 1. `@fastify/middie` path matching for `app.use(&#39;/prefix&#39;, ...)`, and 2. Fastify/find-my-way route lookup normalization.</p> <p>Because middleware and router did not always evaluate the same normalized path, auth middleware could be skipped while route resolution still succeeded.</p> <p>## Workarounds Until patched version is deployed: - Avoid relying solely on path-scoped middie guards for auth/authorization. - Enforce auth at route-level handlers/hooks after router normalization. -…</p> <p><strong>Affected:</strong> npm: @fastify/middie</p> <p>## Summary A path normalization inconsistency in `@fastify/middie` can result in authentication/authorization bypass when using path-scoped middleware (for example, `app.use(&#39;/secret&#39;, auth)`).</p> <p>When Fastify router normalization options are enabled (such as `ignoreDuplicateSlashes`, `useSemicolonDelimiter`, and related trailing-slash behavior), crafted request paths may bypass middleware checks while still being routed to protected handlers.</p> <p>## Impact An unauthenticated remote attacker can access endpoints intended to be protected by middleware-based auth/authorization controls by sending specially crafted URL paths (for example, `//secret` or `/secret;foo=bar`), depending on router option configuration.</p> <p>This may lead to unauthorized access to protected functionality and data exposure.</p> <p>## Affected versions - Confirmed affected: `@fastify/middie@9.1.0` - All versions prior to the patch are affected.</p> <p>## Patched versions - Fixed in: *9.2.0*</p> <p>## Details The issue is caused by canonicalization drift between: 1. `@fastify/middie` path matching for `app.use(&#39;/prefix&#39;, ...)`, and 2. Fastify/find-my-way route lookup normalization.</p> <p>Because middleware and router did not always evaluate the same normalized path, auth middleware could be skipped while route resolution still succeeded.</p> <p>## Workarounds Until patched version is deployed: - Avoid relying solely on path-scoped middie guards for auth/authorization. - Enforce auth at route-level handlers/hooks after router normalization. -…</p> https://cve.radiocsirt.org/vuln/ghsa-8p85-9qpw-fwgw