External risk intelligence

@fastify/middie Access Control Bypass via Request Target Mismatch

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-85184

@fastify/middie is a middleware component for Fastify, a popular framework commonly used to build internet-facing web applications, APIs, and microservices. Because the vulnerability involves bypassing middleware such as authentication on public-facing endpoints, it is highly likely that the vulnerable component is exposed to the internet in typical deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects middleware used in Fastify applications, a common framework for building web services. It allows unauthenticated attackers to bypass access controls, potentially reaching sensitive parts of an application without proper authorization. The main concern is confirming if your Fastify applications rely on this middleware for critical access controls and if they are exposed externally.

Attackers can bypass security checks.
Protects access to services and data.
Confirm relevance for any exposed services.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker on the network can exploit this by sending a specially crafted request to a Fastify application. The application, using @fastify/middie, incorrectly handles absolute-form request targets. This allows the attacker to bypass path-based access controls, such as authentication or authorization middleware, and reach the intended route handler.

Network access required for entry.
Absolute-form request target triggers vulnerability.
Bypasses access controls and reaches route.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could bypass access controls on a Fastify application by exploiting how @fastify/middie and the Fastify router interpret request targets differently. This could allow unauthorized access to routes that are intended to be protected by middleware like authentication or authorization.

Sensitive routes and application logic.
Unauthenticated network requests to specific targets.
Unauthorized access to protected resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability, as it affects middleware within a web framework. The first practical step is to inventory all Fastify applications that use `@fastify/middie`, confirm exposure and business criticality, and then coordinate remediation.

Own the issue: Application owners.
Verify first: Identify and confirm exposure.
Action: Plan and execute upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is @fastify/middie?

@fastify/middie is a middleware engine for the Fastify web framework. Developers use it to integrate Express-style middleware into their applications, allowing them to manage tasks like authentication, session handling, or request logging before a request reaches the final route handler.

How does CVE-2026-85184 cause an access control bypass?

This vulnerability, classified as CWE-436, occurs due to an interpretation mismatch. @fastify/middie evaluates the raw request target, while the Fastify router resolves it to an absolute path. Because these layers analyze different strings, the middleware may fail to recognize a request as needing protection, causing it to skip security checks entirely.

Do I need specific attacker conditions to trigger this bug?

Yes, an attacker must send a request using an absolute-form target, such as a full URL, to the application. Standard requests that do not use this specific absolute-form formatting do not trigger the bypass, meaning the middleware functions as intended under normal traffic conditions.

Why does Halo Surface Signal categorize this as likely exposed?

@fastify/middie is frequently used in web services and APIs built with Fastify, which are often deployed to support internet-facing traffic. Because this flaw targets middleware responsible for authentication, Halo Surface Signal flags it as highly relevant for any public-facing endpoints where security relies on path-scoped checks.

How should I respond to this security advisory?

You should first inventory your applications to identify those using @fastify/middie versions 9.1.0 through 9.3.3. Once identified, prioritize upgrading the component to version 9.3.4 or later, which resolves the mismatch in how request targets are evaluated.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.