Vulnerability Details CVE-2026-85184
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 26.3%
CVSS Severity
CVSS v3 Score 9.1
References
Products affected by CVE-2026-85184
-
cpe:2.3:a:fastify:fastify/middie:9.1.0
-
cpe:2.3:a:fastify:fastify/middie:9.2.0
-
cpe:2.3:a:fastify:fastify/middie:9.3.0
-
cpe:2.3:a:fastify:fastify/middie:9.3.1
-
cpe:2.3:a:fastify:fastify/middie:9.3.2
-
cpe:2.3:a:fastify:fastify/middie:9.3.3