CVE-2026-85184: Fastify Middie Auth Bypass Vulnerability

CVE-2026-85184 Overview

CVE-2026-85184 is an authorization bypass vulnerability in @fastify/middie, the middleware engine plugin for the Fastify web framework. Affected versions are >= 9.1.0 and < 9.3.4. The plugin decides whether to run path-scoped middleware by matching against the raw HTTP request target, while the Fastify router normalizes an absolute-form request target to its path before dispatching. This mismatch allows an unauthenticated network attacker to reach a route handler while path-scoped middleware, such as authentication or authorization checks, is skipped entirely.

Critical Impact

Attackers can send an absolute-form HTTP request to bypass path-based access controls and invoke protected route handlers without authentication.

Affected Products

• @fastify/middie versions >= 9.1.0
• @fastify/middie versions < 9.3.4
• Fastify applications relying on middie for path-scoped authentication or authorization

Discovery Timeline

• 2026-09-04 - CVE-2026-85184 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85184

Vulnerability Analysis

The vulnerability is classified as an interpretation conflict between components [CWE-436]. @fastify/middie and the Fastify core router evaluate different strings when deciding how to process an incoming request. Middie compares path-scoped middleware registrations against the raw request target as received on the wire. The Fastify router, in contrast, resolves an absolute-form target (for example, http://host/protected) down to its origin-form path (/protected) before dispatching the matching route handler.

Because the two layers disagree on the effective path, an attacker can craft a request whose raw target does not match a middleware's path prefix, while the router still resolves the same request to a protected handler. The handler executes without the middleware ever running. In applications that use middie to enforce authentication, authorization, rate limiting, or input validation on a specific path, those controls are silently skipped.

Root Cause

The root cause is inconsistent request-target parsing between middie's path-matching logic and Fastify's router. RFC 7230 permits clients to send requests in absolute-form (GET http://host/path HTTP/1.1) in addition to origin-form (GET /path HTTP/1.1). Middie's matching function did not normalize absolute-form targets to their path component before comparing them to registered middleware prefixes, producing a divergence from how the router dispatched the same request.

Attack Vector

An unauthenticated remote attacker sends an HTTP request using an absolute-form request line targeting a protected route. Middie's path matcher fails to associate the raw target with the registered middleware, so the middleware chain is skipped. The Fastify router then normalizes the target and invokes the protected route handler. No authentication, special privileges, or user interaction are required. Refer to the GitHub Security Advisory GHSA-hx87-8wv7-pjv8 for full technical details.

Detection Methods for CVE-2026-85184

Indicators of Compromise

• HTTP access logs containing request lines in absolute-form, such as GET http://<host>/<path> HTTP/1.1, especially targeting endpoints that should require authentication.
• Successful 2xx responses from protected routes with no corresponding entry in authentication or authorization middleware logs.
• Requests from unauthenticated sources reaching handlers that normally require a session token or API key.

Detection Strategies

• Inspect reverse proxy and Fastify access logs for absolute-URI request targets and correlate them with downstream authorization events.
• Audit dependency manifests (package.json, package-lock.json, yarn.lock) for @fastify/middie versions in the range >= 9.1.0, < 9.3.4.
• Deploy application-layer tests that issue absolute-form requests against protected routes and verify the middleware chain executes.

Monitoring Recommendations

• Alert when handlers for sensitive routes execute without matching authentication middleware telemetry in the same request context.
• Monitor for anomalous request-line formats at the edge, including absolute-form and malformed targets.
• Track version drift of @fastify/middie across production Node.js services in your software composition analysis (SCA) pipeline.

How to Mitigate CVE-2026-85184

Immediate Actions Required

• Upgrade @fastify/middie to version 9.3.4 or later across all Fastify applications.
• Inventory all Node.js services using Fastify and confirm the installed middie version in production and staging environments.
• Review recent access logs for absolute-form request targets against protected routes and investigate any successful responses.

Patch Information

The maintainers released @fastify/middie9.3.4, which normalizes absolute-form request targets to their path component before path-scoped middleware matching. Upgrade using npm install @fastify/middie@^9.3.4 or the equivalent for yarn or pnpm, then redeploy affected services. See the OpenJS Foundation Security Advisories for coordinated disclosure details.

Workarounds

• Terminate HTTP at a reverse proxy such as NGINX or HAProxy and configure it to reject or rewrite absolute-form request targets to origin-form before forwarding to Fastify.
• Enforce authentication and authorization inside route handlers or via Fastify preHandler hooks rather than relying solely on path-scoped middie middleware until the upgrade is complete.
• Block or strip absolute-form request lines at the web application firewall (WAF) layer.

# Configuration example: upgrade @fastify/middie to a fixed version
npm install @fastify/middie@^9.3.4
npm ls @fastify/middie