CVE-2026-85184 @fastify/middie CVE debrief

Who should care

Fastify application developers and administrators who rely on @fastify/middie for path-based access controls should assess their exposure and upgrade to @fastify/middie 9.3.4 or later.

Why it matters

CVE-2026-85184 allows an unauthenticated network attacker to bypass path-based access controls in a Fastify application using @fastify/middie versions >= 9.1.0 and before 9.3.4. Defenders should upgrade to @fastify/middie 9.3.4 or later and review Fastify application configurations.

• Bypass of path-based access controls
• Potential unauthorized access to sensitive data or functionality
• Need for upgrade to @fastify/middie 9.3.4 or later to prevent bypass

Technical summary

The @fastify/middie package versions >= 9.1.0 and before 9.3.4 have a vulnerability that allows an unauthenticated network attacker to bypass path-based access controls in a Fastify application. This is due to the mismatch in how the middleware and the Fastify router evaluate the request target. The vulnerability impacts Fastify application developers and administrators who rely on @fastify/middie for path-based access controls. Users should upgrade to @fastify/middie 9.3.4 or later to prevent bypass of path-based access controls.

Defensive priority

Upgrade to @fastify/middie 9.3.4 or later to prevent bypass of path-based access controls.

Recommended defensive actions

• Upgrade to @fastify/middie 9.3.4 or later
• Review and update Fastify application configurations to ensure path-based access controls are effective
• Monitor for potential bypass attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in @fastify/middie versions >= 9.1.0 and before 9.3.4. The vulnerability allows an unauthenticated network attacker to bypass path-based access controls in a Fastify application.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.