@fastify/middie CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL @fastify/middie CVE published 2026-09-04

CVE-2026-85184

CVE-2026-85184 is a critical vulnerability in @fastify/middie, a middleware plugin for Fastify. The vulnerability allows an unauthenticated network attacker to bypass path-based access controls in a Fastify application that relies on middie for those controls. This is achieved by sending a request with an absolute-form target, which is not properly handled by the path-scoped middleware.