CVEvulnerability

CVE-2026-85184

9.1 CRITICAL Published 2026-09-04 Modified 2026-09-15 Official page ↗
Status
Analyzed
Published
2026-09-04
Last modified
2026-09-15
Assigner
ce714d77-add3-4f53-aff5-83d477b104bb
CVSS 3.1 (ce714d77-add3-4f53-aff5-83d477b104bb)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-436

Description

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.

Affected configurations

• fastify fastify\/middie (>= 9.1.0 < 9.3.4)

Related

Weakness · CWE (1)

  • CWE-436 Interpretation Conflict weakness

References