CVE-2026-85184

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.1.0 through 9.3.3

Description A mismatch occurs because the middleware evaluates the raw request target to determine if path-scoped middleware should run, whereas the Fastify router resolves an absolute-form request target to its path before dispatching. This discrepancy allows a request using an absolute-form target to reach the route handler while skipping path-scoped middleware used for authentication, authorization, rate limiting, or auditing. An unauthenticated network attacker can exploit this behavior to bypass path-based access controls.

Recommendations Update @fastify/middie to version 9.3.4 or later. As a workaround, enforce authentication using a Fastify hook such as preHandler().