{"id":"CVE-2026-85184","title":"@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching.…","summary":"@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching.…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-436"],"vendor":"fastify","product":"fastify/middie","affected":["fastify/middie >= 9.1.0, < 9.3.4"],"patched":["fastify/middie 9.3.4"],"published":"2026-09-04","updated":"2026-09-15","sourceUpdated":"2026-09-15T20:02:28.677","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85184","references":[{"url":"https://cna.openjsf.org/security-advisories.html","label":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"url":"https://github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8","label":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"tags":["nvd"],"epss":0.00316,"epssPercentile":0.24735,"ingestedAt":"2026-09-08T19:08:49.592Z","slug":"CVE-2026-85184","body":"## Overview\n\n@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.\n\n## Affected\n\n- `fastify/middie >= 9.1.0, < 9.3.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `fastify/middie 9.3.4`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}