CVE-2026-85184
Received Received - Intake

Path-Scoped Middleware Bypass in Fastify Middie

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: openjs

Description
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
2026-09-04
NVD
CVE-2026-85184
EUVD
EUVD-2026-70979

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fastify middie From 9.1.0 (inc) to 9.3.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @fastify/middie package versions 9.1.0 to 9.3.3. It allows requests using absolute-form URLs (e.g., GET http://anything/private/secrets) to bypass path-scoped middleware like authentication or authorization. The issue occurs because middie checks the raw request target while Fastify's router resolves the path before dispatching, causing a mismatch where middleware is skipped even though the route handler is reached.

Detection Guidance

Check if your system uses @fastify/middie versions between 9.1.0 and 9.3.3 by running: npm list @fastify/middie. If the version is within this range, the system is vulnerable.

Impact Analysis

An unauthenticated attacker could exploit this to bypass access controls on protected routes in a Fastify application using middie for authentication or authorization. This could lead to unauthorized access to sensitive data or functionality, compromising confidentiality and integrity of the application.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR (Article 32) and HIPAA (Security Rule). Organizations using affected versions may face legal and regulatory penalties due to insufficient access controls.

Mitigation Strategies

Upgrade @fastify/middie to version 9.3.4 or later using: npm update @fastify/middie. Alternatively, implement authorization checks in a Fastify preHandler hook as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart