Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Anyone who can hit your Fastify app with a weird-looking request can walk past the auth middleware you thought was guarding a route. Upgrade @fastify/middie to 9.3.4. CVE-2026-85184 https://hol.org/blog/cve-2026-85184-fastify-middie-absolute-form-middleware-bypass https://t.co/7S4A7H7OIA
Post summary
The CVE-2026-85184 flaw allows malicious requests to bypass authentication in Fastify apps; users are urged to upgrade to version 9.3.4.
Absolute-form request targets can skip path-scoped auth middleware in Fastify apps. CVE-2026-85184 Affected: @fastify/middie 9.1.0 to 9.3.3 Fixed: 9.3.4 Details: https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-85184
Post summary
Fastify's @fastify/middie 9.1.0-9.3.3 allows absolute-form requests to skip auth middleware; fixed in 9.3.4, with details available on Vulmon.
CVE-2026-85184 @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router r… https://www.cve.org/CVERecord?id=CVE-2026-85184
Post summary
The snippet announces CVE‑2026‑85184, outlining affected Fastify/middie versions and describing a technical flaw, but it offers no PoC, exploit, or mitigation details.
🚨 Critical-severity security fix in @fastify/middie@9.3.4 just released! Patches CVE-2026-85184: path-scoped middleware bypass via absolute-form request target. https://github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8
Post summary
Fastify released a critical‑severity patch for middie v9.3.4 to fix CVE‑2026‑85184, a path‑scoped middleware bypass via absolute‑form request target, with details available in a GitHub advisory.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify\/middie | - | node.js | - |