- The Mess: @fastify/middie has a nasty path-matching flaw that can make authentication and authorization middleware simply disappear. CVE-2026-85184 affects versions 9.1.0 through 9.3.3 and carries a CVSS 9.1 Critical score.
The bug lives in the disagreement between two pieces of the Fastify stack.
@fastify/middie checks the raw HTTP request target to decide whether path-scoped middleware should run. The Fastify router, meanwhile, normalizes an absolute-form HTTP request target before routing it.
Those two components can therefore see two different paths.
An attacker can send an HTTP request using an absolute-form target instead of the usual relative path. Middie may fail to recognize that the request belongs to a protected path, while the Fastify router still resolves and dispatches it to the intended route.
In other words: the security guard checks the envelope, the router opens it, and they disagree about what was written on the front.
- The Damage: An unauthenticated remote attacker can potentially reach endpoints that were supposed to be protected by path-scoped authentication or authorization middleware.
This is not an RCE in Fastify itself. The impact depends on what the skipped middleware was protecting.
That can still be ugly.
If an application uses something equivalent to a path-scoped middleware for /admin, /private, /internal, API management endpoints or other sensitive routes, the middleware may be skipped while the actual route handler continues executing.
The CVSS vector reflects that risk: network reachable, low attack complexity, no privileges and no user interaction, with high confidentiality and integrity impact.
The vulnerability is tracked as CWE-436, an interpretation conflict between components processing the same input differently.
And this is exactly the kind of bug defenders hate: nothing needs to crash, nothing needs to be corrupted and no spectacular exploit chain is required. Two pieces of otherwise legitimate infrastructure simply need to disagree.
- The Fix: Upgrade
@fastify/middieto 9.3.4 or later immediately if your application uses an affected version and relies on path-scoped middleware for access control.
Administrators should also check which version is actually installed rather than assuming the application is running the newest package:
npm ls @fastify/middie
If upgrading is temporarily impossible, security-sensitive authorization should not depend solely on path-scoped middie middleware. Moving authentication and authorization checks into Fastify hooks such as preHandler provides a safer control point after routing has resolved the request path.
One particularly nasty detail: upgrading to 9.3.3 is not enough. The affected range ends before 9.3.4, so applications patched for earlier middie request-parsing issues can still be exposed to this separate absolute-form request problem.
There is currently no indication that CVE-2026-85184 is being actively exploited, and it is not listed as a CISA KEV vulnerability in the available tracking data. That does not make a CVSS 9.1 authentication bypass particularly comforting.
Bugstoday’s Opinion
This is a beautiful example of how security bugs actually happen.
Nobody needed to invent a new protocol. Nobody needed a zero-day in some exotic cryptographic library. One component parsed an HTTP request one way, another parsed it differently, and the authorization boundary fell between them.
If your security model depends on middleware deciding which routes are protected, patch first and investigate second.
Because once an attacker starts looking for parser disagreements, “protected endpoint” becomes more of a suggestion than a security control.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
OpenJSF / CVE-2026-85184
@fastify/middie Security Advisory GHSA-hx87-8wv7-pjv8
CVE.org / MITRE
NVD
Fastify / middie 9.3.4 patch
