BREAKING: CVE-2026-85184 lets absolute-form requests skip Fastify middie auth

An unauthenticated request can skip path-scoped auth middleware in Fastify apps that use @fastify/middie. Middie decides whether to run path-scoped auth by looking at the raw request target. Fastify router find-my-way first turns an absolute-form target into a path, then routes it. Those two strings disagree, so GET http://evil.example/private/secrets HTTP/1.1 can reach the handler while middleware never runs.

This is the same class of middie bypass as earlier encoded-slash and child-scope cases, but a different trigger. Operators who already moved to 9.3.3 for percent-2F fixes are still exposed until 9.3.4.

What breaks

HTTP/1.1 allows an absolute-form request target: scheme, host, then path on the request line. Proxies and some clients send that form. find-my-way strips the authority and matches on the path. Until 9.3.4, middie normalizePathForMatching left a target that did not start with slash alone, so path-scoped prefix /private did not match. The router still dispatched /private/secrets.

The security regression test in the 9.3.4 tree drives this over a raw TCP socket. Targets that bypassed middleware before the fix include http://evil.example/private/secrets, mixed-case schemes, userinfo in the authority, and absolute-form URLs with a query string. Parameterized middleware and child plugin scope failed the same way.

OpenJS GHSA-hx87-8wv7-pjv8 rates this Critical CVSS 9.1, network, no privileges, no user interaction. Impact is whatever skipped middleware was supposed to enforce. It is not remote code execution by itself.

Who is not in scope

• Fastify apps that never register @fastify/middie.
• Apps that put auth in Fastify hooks preHandler or onRequest after the router resolved the path.
• @fastify/middie older than 9.1.0 (gap is for versions from 9.1.0 up to but not including 9.3.4).
• Express-only stacks, or Connect middleware outside Fastify router pairing.
• Non-http/https absolute targets: patch leaves unsupported schemes unmatched.

How to check

From the app root list the middie package version.

npm ls @fastify/middie

If installed version is from 9.1.0 up to but not including 9.3.4, you are in range. Then search for path-scoped use registrations.

Any path-scoped registration that gates auth is the pattern. Global middleware with no path prefix is a different threat model.

How to fix

Upgrade the middie package to 9.3.4 or later.

npm install @fastify/[email protected]

The 9.3.4 patch adds getPathFromAbsoluteUrl inside normalizePathForMatching so middie mirrors find-my-way. Matteo Collina shipped the bump on 2026-09-04; registry latest is already 9.3.4.

If you cannot upgrade immediately, move auth into a Fastify preHandler after routing. That is the advisory workaround.

What this is not

This is not a Fastify core router RCE, not a default-install worm, and not the earlier middie percent-encoded-slash or duplicate-slash issues. Absolute-form is a third disagreement. Patching only to 9.3.3 does not close CVE-2026-85184.

References

• GHSA-hx87-8wv7-pjv8
• middie v9.3.3 to v9.3.4 patch
• npm @fastify/middie
• HOL Guard evidence pack for CVE-2026-85184