---
id: CVE-2026-85184
title: >-
  @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run
  path-scoped middleware by matching against the raw request target, while the
  Fastify router resolves an absolute-form request target to its path before
  dispatching.…
summary: >-
  @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run
  path-scoped middleware by matching against the raw request target, while the
  Fastify router resolves an absolute-form request target to its path before
  dispatching.…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-436
vendor: fastify
product: fastify/middie
affected:
  - 'fastify/middie >= 9.1.0, < 9.3.4'
patched:
  - fastify/middie 9.3.4
published: '2026-09-04'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T20:02:28.677'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85184'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: 'https://github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
tags:
  - nvd
epss: 0.00523
epssPercentile: 0.41832
ingestedAt: '2026-09-08T19:08:49.592Z'
---

## Overview

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.

## Affected

- `fastify/middie >= 9.1.0, < 9.3.4`

## Remediation

Upgrade past the affected range:

- `fastify/middie 9.3.4`