CVE-2026-85184

@fastify/middie, the middleware engine used to run Express-style middleware inside Fastify, decides whether to run path-scoped middleware by matching the raw request target, while Fastify's router resolves absolute-form request targets to their path before dispatching, so the two layers evaluate different strings (a CWE-436 interpretation conflict). An unauthenticated network attacker can send a request whose request line uses an absolute-form target, which then reaches the route handler while path-scoped middleware such as authentication or authorization is skipped. The attacker gains the ability to bypass path-based access controls in the affected application and reach protected endpoints without credentials. Affected users are operators of Fastify applications running @fastify/middie 9.1.0 through 9.3.3 that rely on middie path-scoped middleware for access control on reachable routes. There is no public proof of concept, the flaw is not in CISA KEV, and EPSS estimates a 0.3% 30-day exploitation probability, so no exploitation is currently known.

What to do: Upgrade to @fastify/middie 9.3.4 or later. As an interim mitigation, do not rely on middie path-scoped middleware for authentication or authorization on internet-facing routes; enforce access control in Fastify's own lifecycle hooks (which see the resolved route) or normalize request targets at the proxy layer. Audit your Fastify applications for @fastify/middie in the 9.1.0-9.3.3 range and check whether any front-end proxy forwards absolute-form request targets to the application.