CVE-2026-85184: @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify…

PriorityP264critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EPSS

0.32%

24.7th percentile

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
fastify	fastify_middie	>= 9.1.0 < 9.3.4	9.3.4
fastify	middie_fastify_middie	>= 9.1.0 < 9.3.4	9.3.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.