# CVE-2026-85184

## Summary

- **CVE ID:** CVE-2026-85184
- **Severity:** CRITICAL
- **CVSS Score:** 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **CWE:** CWE-436
- **Published:** Sep 4, 2026
- **Last Modified:** Sep 4, 2026

## Description

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.

## Affected Products

- @fastify/middie — @fastify/middie (9.1.0)
- @fastify/middie — @fastify/middie (9.3.4)

## References

- [CNA](https://github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8)
- [CNA](https://cna.openjsf.org/security-advisories.html)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.33%
- **EPSS Percentile:** 26.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._