Activity

1. melvincarvalho commented on Feb 23, 2026

   

   melvincarvalho

   on Feb 23, 2026

   ContributorAuthor

   More actions

   Investigation Findings

   CVE: Middleware path bypass via URL encoding — attacker can use /%61dmin to bypass middleware protecting /admin.

   JSS impact: Low. JSS uses @fastify/middie only to bridge oidc-provider (Koa) into Fastify. It's registered globally without path-based filtering, so there's no path-scoped middleware to bypass.

   Blocker: @fastify/middie@^9.1.0 (the fix) requires Fastify 5. Upgrading middie alone causes:

   FastifyError: @fastify/middie - expected '5.x' fastify version, '4.29.1' is installed
   

   Recommendation: Bundle this fix with the Fastify 4→5 migration (#125). No urgent action needed given low practical impact on JSS's current usage.
2. melvincarvalho commented on Feb 23, 2026

   

   melvincarvalho

   on Feb 23, 2026

   ContributorAuthor

   More actions

   Fastify 5 Upgrade Assessment

   Since @fastify/middie@^9.1.0 requires Fastify 5, here's the migration assessment:

   Difficulty: ~2/10

   Only 1 actual code change needed:

   • server.js:372 — reply.redirect(302, url) → reply.redirect(url, 302) (args reversed in v5)

   Everything else JSS already does correctly:

   • ✅ .listen({ port }) — already used
   • ✅ reply.hijack() — already used
   • ✅ No reply.sent, no req.connection, no route schemas, no deprecated route properties

   Dep bumps needed:

   • fastify → ^5
   • @fastify/middie → ^9.1.0
   • @fastify/websocket + @fastify/rate-limit — check compatible versions
   • engines.node → >=20

   One thing to verify: request.hostname no longer includes port in v5 (~20 uses across the codebase). JSS already strips port in some places (passkey.js), but needs a test pass.

   Recommendation: Single PR covering Fastify 5 + middie 9.1.0. Roughly 1 hour of work.
3. melvincarvalho

   added

   bugSomething isn't workingSomething isn't working

   on May 12, 2026