Path Scoping Issue in Fastify Middleware Affects Application Security

CVE-2026-85184

What is CVE-2026-85184?

In affected versions of @fastify/middie, there is a flaw in how path-scoped middleware evaluates the raw request target. This discrepancy can allow an unauthenticated network attacker to bypass critical access controls, such as authentication and authorization mechanisms. When the Fastify router processes requests, it resolves an absolute-form target to its path, whereas the middleware layer uses the raw request target for its evaluations. As a result, certain request types can reach the route handler without triggering necessary middleware checks. Upgrade to @fastify/middie version 9.3.4 or newer to mitigate this risk.

References