Loading story…
Two critical vulnerabilities have been disclosed in Fastify middleware integrations that can let requests reach protected application routes without triggering expected security checks. CVE-2026-6556 affects @fastify/express through version 4.0.6, where middleware mounted with non-string paths such as arrays or regular expressions inside prefixed plugins is forwarded to Express without the Fastify prefix rewrite. That mismatch can cause authentication, authorization, rate-limiting, and auditing middleware to be skipped on prefixed routes, potentially exposing endpoints to unauthenticated users.
A separate flaw, CVE-2026-14198, affects @fastify/middie versions 9.1.0 through 9.3.2 because encoded slashes (%2F) in path parameters are decoded before middleware path matching, while Fastify routing preserves the encoding. The resulting path canonicalization mismatch can bypass middleware on parameterized routes even though the target handler still executes, and the issue is described as HTTP method agnostic with no authentication required. Recommended remediation is to upgrade to @fastify/express 4.0.7 or later and @fastify/middie 9.3.3, while interim mitigations include using string-only middleware mount paths, avoiding parameterized middleware paths for security decisions, and enforcing access checks in route handlers or Fastify hooks after router resolution.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-14198 was published for a critical authorization bypass vulnerability in @fastify/middie affecting versions 9.1.0 through 9.3.2. The issue stems from encoded slash decoding in path parameters before middleware matching, and the recommended fix is upgrading to version 9.3.3.
CVE-2026-6556 was published for a critical middleware bypass vulnerability in @fastify/express affecting version 4.0.6 and earlier. The disclosure stated the issue could allow authentication, authorization, rate limiting, or auditing middleware to be skipped on prefixed routes and recommended upgrading to 4.0.7 or later.
A GitHub security advisory disclosed an authorization bypass vulnerability in @fastify/express affecting versions up to 4.0.6, caused by non-string mount paths in prefixed plugins not being rewritten correctly. The advisory also described using string paths instead of arrays or regexes in prefixed plugins as a workaround.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in **Next.js** tracked as `CVE-2025-29927` allows attackers to bypass authorization controls when applications rely on **Middleware** for access checks under specific deployment conditions. Researchers showed that specially crafted requests using the `x-middleware-subrequest` header can cause Middleware processing to be skipped, forwarding requests directly to protected endpoints. The issue was described as an authorization bypass with a **CVSS 9.1** severity rating and was later detailed by the Next.js team in a postmortem. The flaw affects multiple Next.js release lines, with fixes released in **15.2.3**, **14.2.25**, **13.5.9**, and **12.3.5**. Guidance from defenders and the vendor says organizations should patch immediately, and those unable to update should block external requests containing the `x-middleware-subrequest` header. The exposure is tied to applications run with `next start` using the `output: 'standalone'` setting, while hosted Next.js deployments on **Vercel** and **Netlify** were reported as protected from this issue.
Sep 3, 2026
A critical **Next.js** flaw tracked as `CVE-2025-29927` exposed applications using middleware-based authorization to authentication and authorization bypass, allowing protected routes to be reached without intended access checks. Public reporting described the issue as a middleware bypass bug affecting deployments that relied on Next.js middleware for security decisions, prompting urgent guidance for defenders to identify exposed internet-facing applications and remediate vulnerable implementations. The vulnerability was rapidly operationalized after disclosure, with multiple GitHub repositories publishing **proof-of-concept exploits**, vulnerable demo apps, Docker labs, and automated detection tools. These included scanners and hunters designed to identify susceptible Next.js sites, as well as exploitation-focused projects advertising middleware auth bypass and route access validation, increasing the likelihood of broad reconnaissance and opportunistic abuse against unpatched environments.
Jul 12, 2026
Vercel has patched three high-severity vulnerabilities in **Next.js** that could allow **server-side request forgery (SSRF)** and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as `CVE-2026-64645`, `CVE-2026-64649`, and `CVE-2026-64642`, each rated **CVSS 8.3**, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the **App Router** and **Turbopack** in a limited scenario. The issues were fixed in **Next.js 16.2.11** and **15.5.21**, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate `Host` and `X-Forwarded-Host` headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Jul 23, 2026