@fastify/middie CVE-2026-85184

Exploitation requires that the target Fastify application uses @fastify/middie (9.1.0-9.3.3) with PATH-SCOPED middleware - i.e. middleware registered against a specific path/prefix - to enforce authentication or authorization, and that the server accepts absolute-form request targets (targets beginning with a scheme such as 'http://host/...'). The attacker sends such an absolute-form request to a protected route; middie's raw-target match misses while the router resolves the path and dispatches the handler. It is unauthenticated, network-reachable, and needs no user interaction (AV:N/AC:L/PR:N/UI:N). Limiting factors: applications that enforce access control via per-route Fastify hooks (onRequest/preHandler) rather than path-scoped middie middleware, or that reject absolute-form targets at a proxy, are not exploitable; apps using middie only for non-security middleware (logging, body parsing) face no access-control impact.

The vendor CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), which is consistent with the description: a network-reachable, unauthenticated, low-complexity request that requires no user interaction and yields high confidentiality and integrity impact by reaching handlers that should have been gated. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so this is a high-severity-by-design issue rather than a confirmed exploited one - the risk is driven by how easy it is to trigger, not by observed attacks. The A:N rating is appropriate because the bypass exposes/alters protected functionality rather than crashing the service, though downstream availability impact is possible if the now-reachable handlers perform destructive actions. Realistically, any Fastify deployment that enforces authn/authz through path-scoped middie middleware is exposed regardless of size, and such teams should prioritize the upgrade quickly given the trivial exploitation path. The main uncertainty is deployment-specific: apps that authenticate via per-route hooks or Fastify onRequest hooks rather than path-scoped middie middleware are not affected, so blast radius depends on how each application wires its access controls.

A Fastify app protects /admin with path-scoped middie authentication middleware. An unauthenticated attacker sends a request with an absolute-form target ('GET http://victim.example/admin/users HTTP/1.1'); middie fails to match the /admin scope and skips the auth middleware, while Fastify's router resolves the target to /admin/users and invokes the real handler, returning protected data or performing privileged actions. No authentication, user interaction, or special tooling is required, though no public PoC was identified at time of analysis.