CVE-2026-85184 @fastify/middie CVE debrief

Who should care

Fastify application developers and administrators who use @fastify/middie for path-based access controls should assess their exposure and upgrade to @fastify/middie 9.3.4 or later.

Why it matters

CVE-2026-85184 is a critical vulnerability in @fastify/middie that allows unauthenticated network attackers to bypass path-based access controls in Fastify applications. Developers and administrators should assess their exposure and upgrade to @fastify/middie 9.3.4 or later.

• Bypassing path-based access controls can allow unauthorized access to sensitive data or functionality
• Unauthenticated network attackers can exploit this vulnerability to gain access to restricted areas of the application
• The vulnerability can be used to bypass authentication or authorization mechanisms
• Verification of the vulnerability and affected versions is necessary to ensure proper remediation

Technical summary

The vulnerability is caused by the way @fastify/middie handles path-scoped middleware. The plugin decides whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. This discrepancy allows an attacker to bypass path-based access controls. Affected product deployments should be reviewed for exposure and upgraded to @fastify/middie 9.3.4 or later to mitigate the vulnerability. The vulnerability can be exploited by sending a request with an absolute-form target, which is not properly handled by the path-scoped middleware.

Defensive priority

High

Recommended defensive actions

• Upgrade to @fastify/middie 9.3.4 or later
• Review and update Fastify application configurations to ensure proper use of path-scoped middleware
• Monitor application logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the way @fastify/middie handles path-scoped middleware. The plugin decides whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. This discrepancy allows an attacker to bypass path-based access controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.