CVE-2026-85184: @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@fastify/middieto a version that resolves this vulnerability.Fixed in 9.3.4
Event History
Frequently Asked Questions
Which applications are exposed to this bypass?
Applications using @fastify/middie versions 9.1.0 through before 9.3.4 are exposed if they rely on path-scoped middie middleware for authentication, authorization, or other access controls. The issue is reachable over the network without authentication or user interaction.
What does an attacker need to do to exploit it?
An attacker sends a request with an absolute-form request target. Fastify resolves that target to a path for route dispatch, while the affected middie versions use the raw target when deciding whether path-scoped middleware applies.
How can the issue be remediated?
Upgrade @fastify/middie to version 9.3.4 or later. This aligns middleware matching with Fastify's handling of absolute-form request targets.