What’s Vulnerable › Vulnerabilities

CVE-2026-85184: @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-15
• Weakness: CWE-436

Description

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.

Affected products

• fastify middie: from 9.1.0 before 9.3.4 — fixed in 9.3.4

How to fix

Upgrade to a fixed version: fastify middie 9.3.4. Check the vendor advisory for mitigations.

References

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8

Get alerted when CVE-2026-85184 or the next vulnerability affects your stack