Originally published at HOL

An unauthenticated request can skip path-scoped auth middleware in Fastify apps that use @fastify/middie. Middie decides whether to run path-scoped auth by looking at the raw request target. Fastify router find-my-way first turns an absolute-form target into a path, then routes it. Those two strings disagree, so GET http://evil.example/private/secrets HTTP/1.1 can reach the handler while middleware never runs.

This is the same class of middie bypass as earlier encoded-slash and child-scope cases, but a different trigger. Operators who already moved to 9.3.3 for percent-2F fixes are still exposed until 9.3.4.

What breaks

HTTP/1.1 allows an absolute-form request target: scheme, host, then path on the request line. Proxies and some clients send that form. find-my-way strips the authority and matches on the path. Until 9.3.4, middie normalizePathForMatching left a target that did not start with slash alone, so path-scoped prefix /private did not match.…