@fastify/middie
9.3.6 · 20 Oct 2026MIT1.2M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @fastify/middie. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 9.3.6 | Safe from 9.3.2 | |
| 8.3.3 | 4 open advisories, worst critical · last release Sep 2024, no longer updated |
- Critical@fastify/middie vulnerable to middleware authentication bypass in child plugin scopesGHSA-72c6-fx6q-fr5w · 16 Apr 2026
- 9.x9.0.0 – 9.3.1Fixed in 9.3.2
- 8.x8.0.0 – 8.3.3No fix on 8.x · move to 9.3.2
- High@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes optionGHSA-v9ww-2j6r-98q6 · 16 Apr 2026
- 9.x9.0.0 – 9.3.1Fixed in 9.3.2
- 8.x8.0.0 – 8.3.3No fix on 8.x · move to 9.3.2
- High@fastify/middie has Improper Path Normalization when Using Path-Scoped MiddlewareGHSA-8p85-9qpw-fwgw · 28 Feb 2026
- 9.x9.0.0 – 9.1.0Fixed in 9.2.0
- 8.x8.0.0 – 8.3.3No fix on 8.x · move to 9.2.0
- HighFastify Middie Middleware Path BypassGHSA-cxrg-g7r8-w69p · 20 Jan 2026
- 9.x9.0.0 – 9.0.3Fixed in 9.1.0
- 8.x8.0.0 – 8.3.3No fix on 8.x · move to 9.1.0
Registry facts last checked 23 Oct 2026. Releases and advisories last read 23 Oct 2026.