CVE-2026-85184 in middie
Summary
by MITRE • 09/04/2026
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in versions of the fastify/middie package ranging from 9.1.0 up to, but not including, version 9.3.4 represents a critical logic flaw within the middleware execution pipeline of Fastify applications. This issue stems from an inconsistency in how request targets are parsed and matched across different layers of the application stack. Specifically, fastify/middie determines whether path-scoped middleware should be executed by matching against the raw request target as received directly from the network connection. In contrast, the underlying Fastify router normalizes absolute-form HTTP requests into their corresponding URI paths before dispatching them to route handlers. This divergence in parsing logic creates a discrepancy where the two components evaluate different string representations of the same incoming request.
When an attacker sends an HTTP request using an absolute-form target, such as one that includes the full scheme and host alongside the path (e.g., GET http://example.com/admin HTTP/1.1), the Fastify router correctly resolves this to the /admin path and routes it to the appropriate handler. However, because @fastify/middie operates on the raw request target string rather than the normalized path, its matching logic fails to recognize that the request is intended for a protected route. Consequently, any middleware configured specifically for that path scope, such as authentication or authorization checks implemented via middie, is bypassed entirely. The application proceeds to execute the route handler without enforcing the security controls defined in the skipped middleware layer.
The operational impact of this vulnerability is severe, particularly for applications relying on @fastify/middie to enforce access control policies. An unauthenticated network attacker can exploit this discrepancy to circumvent path-based authentication and authorization mechanisms. By crafting requests with absolute-form URIs, an attacker can gain unauthorized access to sensitive endpoints that are supposed to be protected by middleware checks. This effectively nullifies the security posture provided by these middleware layers, potentially leading to data breaches, privilege escalation, or other malicious activities depending on the functionality exposed by the unprotected routes. The flaw is particularly dangerous because it allows bypassing of security controls without triggering typical error responses or requiring complex exploitation techniques beyond standard HTTP request formatting.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as well as CWE-697, Incorrect Comparison, due to the mismatch between raw and normalized string comparisons in access control logic. From an ATT&CK perspective, this technique relates to T1078, Valid Accounts, specifically through authentication bypass techniques that allow attackers to maintain persistence or escalate privileges by evading detection mechanisms. To mitigate this risk, developers must upgrade @fastify/middie to version 9.3.4 or later, where the middleware matching logic has been corrected to align with the router's normalization process. Additionally, organizations should review their dependency management practices and ensure that all packages are kept up-to-date to prevent exposure to known logical flaws in security-critical components.